MFA Once Per Session Action

Knowledge Articles
1

Last Updated: Nov 29, 2024

Overview

This article details how to write an MFA Once Per Session Action.

Applies To

  • Action
  • Multifactor Authentication (MFA)
  • Single Page Application (SPA)

Solution

The below can be used to avoid prompting a user for multifactor authentication if they have successfully completed MFA in their current session.

/* triggers MFA once per session */
exports.onExecutePostLogin = async (event, api) => {
	if (!event.authentication.methods.find(({ name }) => name === 'mfa') ) {
       api.multifactor.enable("any", { allowRememberBrowser: true });
    }
};

This is particularly useful when performing silent authentication (prompt=none & response_mode=web_message) to renew short-lived access tokens in a Single Page Application (SPA) during the duration of a user’s session.

allowRememberBrowser must be set to false. f the user chooses to remember the browser for 30 days, the ‘mfa’ value will not be present in the array, and this will conflict with the expected behavior of this action.

See Set allowRememberBrowser Using api.authentication.challengeWith for more details.