Require MFA Only at Login

Get Help
,
1

When MFA is enabled, I’m prompted to enter a one-time password every time I reload the browser.

Is it possible to require the one-time password only at the time of login?

I’m using Auth0 Vue SDK.
And the MFA is called within a Post Login Action as shown below.

exports.onExecutePostLogin = async (event, api) => {
    if (event.user.user_metadata.use_mfa == 1){
        api.multifactor.enable('guardian', { allowRememberBrowser: false });
    }
};
3

Hi @t.fukao,

Welcome back to the Auth0 Community!

The reason the user is prompted for MFA again is that Actions are executed during each login, which includes both standard login and silent authentication requests or Refresh Token exchanges.

To ensure that your Action does not run on subsequent logins, you can enforce your action code to check for:

  1. A refresh token exchange
if(event.transaction.protocol === "oauth2-refresh-token"){
        return;
  }
  1. A silent authentication
if(event.request.query.response_mode === 'web_message'){
       return;
 }

I hope this helps!
Best regards,
Remus

1 Like
4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.