Feature: More Flexible MFA Device Trust and Remember Browser Controls
Description:We would like MFA to be required again only for users who have not logged in for 10 days after completing MFA authentication. Active users who continue to log in should not be prompted for MFA again.
We would also like to hide the “Remember this device” checkbox on the MFA challenge screen.
Although similar behavior can be achieved with allowRememberBrowser and Device Trust Duration, the current implementation does not fully satisfy the following requirements.
Use Case:A customer requires MFA only when a user has been inactive for a certain period after completing MFA authentication. Users who regularly access the service should not be required to perform MFA repeatedly.
Requested Enhancements
- Extend the trusted period on each login
Currently, MFA is required once the configured Device Trust Duration expires, even if the user has logged in during that period.
We would like an option to refresh or extend the trusted period whenever the user successfully logs in.
- Configurable cookie expiration
Currently, a browser may require MFA again after the MFA cookie expires (currently 7 days), even if the Device Trust Duration has not yet expired.
We would like administrators to be able to configure the cookie expiration period.
- More control over the “Remember this device” option
When allowRememberBrowser is enabled, the “Remember this device” checkbox cannot be controlled.
We would like the following options:
Show or hide the checkbox
Select “Remember this device” by default
Select “Do not remember this device” by default
These enhancements would provide greater flexibility for organizations to align MFA behavior with their security policies and user experience requirements.