Authdog
Back to journal
Product UpdatesAuthenticationSecurity

MFA is enforced before the session completes

Configured MFA policy is now enforced before an authentication session completes.

From the changelog: MFA enforcement during sign-in

Authdog Team

2 min read
Centered Authdog mark with angled MFA and Gate word plates on a grainy navy wash with a dashed challenge lock

A second factor only matters if it runs before the session is usable. When MFA is configured for the environment, Authdog now enforces that policy before the authentication session completes, instead of issuing a normal session and hoping a later check catches up.

This is the longer note behind the May 27 changelog entry.

How it works

After primary authentication succeeds, hosted sign-in can defer access and refresh cookies. It keeps a pending authentication state and sends the user to a dedicated MFA challenge. Only a successful verification completes sign-in and issues the session.

The pending state is bound to the environment and holds the original continuation. A missing, expired, or wrong-environment state returns the user to sign-in. Outcomes are recorded for audit and event processing: failed codes as authentication failure activity, successful completion as MFA sign-in activity.

Do not call the hosted MFA verify route from your application. It is part of the hosted identity flow, not a public management API. Behavior is in MFA.

Set it up

In the Authdog console:

  1. Enable multi-factor authentication on the environment.
  2. Enroll at least one verified factor on a test user (TOTP, SMS, or push).
  3. Sign in on the hosted Account Portal and complete the MFA screen.
  4. Confirm the session is issued only after verification, and that a failed code does not complete sign-in.

Keep development and production settings separate. Enabling the environment gate does nothing for a user with no enrolled factor.

Trust boundaries

The MFA screen is a second-factor check on a pending sign-in. It is not phishing-resistant when the factor is TOTP, and it is not authorization for your APIs. Validate the final Authdog session on the backend.

Pending state lives in Authdog-managed cookies on the hosted flow. A copied access token from a completed session is not the pending challenge, and the pending challenge is not a session.

Try it

Enable MFA, enroll a test user, and complete a sign-in through the challenge. Details are in MFA. The original release note is in the changelog.

More from Authdog
ShareLinkedInX