If MFA enabled reloading of page leads to 'login_required' error

[alexey-tikhonok]

Any reloading of pages (or direct link to any page) for a case with Multi-Factor Authentication enabled and "Remember this device for 30 days" checkbox control is NOT checked leads to "login_required" error.

The expected behavior is - reloading (or loading by direct link) of just logged in page without an additional authentication.

To reproduce this error enable multi-factor authentication for angular application and follow steps:

• 1 Login to an angular application.
• 2 During authentication, keep checkbox "Remember this device for 30 days" as not checked.
• 3 Reload angular application using F5 or direct link to any page.

The actual behaviour is getting of an error 'login_required' with error description 'Multifactor authentication required' (see image).

These conditions (MFA enabled + "Remember this device for 30 days" is not checked) lead to the same error for silent authetication.

[frederikprijck]

Hello,

Thank you for reaching out.
Somewhere this or next week, I will be looking at the behavior, see if I can reproduce it as well as why this is occurring.

Thank you for your patience.

[midthun]

I had a similar issue, it was not working correctly when refreshing our Angular app in Brave and Safari, so I had to add some configuration settings when calling auth0:

{
   ...,
   cacheLocation: 'localstorage',
   useRefreshTokens: true
}

[frederikprijck]

What is happening is the following:

• MFA is configured
• User log's in and is prompted with MFA, but does not check the Remember this device for 30 days

This basically means that the user will be prompted for MFA every time they are sent to the /authorize endpoint (either through loginWithRedirect, or by our Silent Authentication, which calls that same /authorize endpoint using an iframe).

Our Silent Authentication will fail and throw the Multifactor authentication required error. Our SDK can't know how your application wants to handle these errors, so we are not doing anything as a reaction to that error.
The idea here is to catch that error and act accordingly (e.g. call loginWithRedirect()).

I agree that it is extremely inconvenient to always be prompted for MFA on every page refresh. I believe there are two things that can help avoid that:

1. Ensure the users are informed that is the consequence of not checking the remember device checkbox, and that they can check the checkbox if they don't like the experience.
2. As mentioned by @midthun, using localstorage and refreshtokens will remove the issue regarding silent authentication as well as page refreshing.

I do not believe there is much we can do from an SDK side, but we will add a section about this behavior in our FAQ.

[alexey-tikhonok]

Thank you @frederikprijck for your answer!
It would be really good to have a description to the behavior in your documentation to point out to our client.
I'll only add a couple of words about using localstorage - it is most insecure option to store token, especially when you use most secure type of authentication - MFA.

[frederikprijck]

@alexey-tikhonok I totally agree with local storage being the least secure option. Keeping everything in memory is what we do by default.

I would see if you can either convince people to select Remember this device or accept the fact that a page refresh requires a redirect for MFA. In that case, there is no need to be storing tokens in local storage. If not, I believe you will need to use local storage here. I would still recommend using Rotating RefreshTokens regardless, to ensure you don't end up with failing Silent Authentication calls due to MFA .