Step-up authentication in Auth0 using Actions

step-up-auth-action.js

exports.onExecutePostLogin = async (event, api) => {
  const CLIENTS_NEEDING_MFA = [
    "CLIENT_ID_NEEDING_MFA_1",
    "CLIENT_ID_NEEDING_MFA_2"
  ];

  if (!CLIENTS_NEEDING_MFA.includes(event.client.client_id)) {
    return;
  }

  if (event.request.query.acr_values !== "AuthID_MFA_ACR"){
    return;
  }

  api.multifactor.enable("any", { allowRememberBrowser: false });
};