Skip to content

[Access] Clarify MFA session behavior #33370

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
kennyj42 wants to merge 1 commit into
base: production
Choose a base branch
from
+18 −1
Draft

[Access] Clarify MFA session behavior #33370

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion ...tent/docs/cloudflare-one/access-controls/access-settings/session-management.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,22 @@ This account setting only applies to failed Cloudflare One Client authentication

### MFA session duration

If you use [independent multi-factor authentication (MFA)](/cloudflare-one/access-controls/access-settings/independent-mfa/), the MFA session duration determines how long a user can log in to Cloudflare Access without being prompted for MFA. The MFA session is independent of the global, policy, and application session durations. When logging in to an Access app with [MFA enabled](/cloudflare-one/access-controls/policies/mfa-requirements/#configure-independent-mfa-for-an-application), users must complete an MFA challenge if their last MFA authentication falls outside the configured session duration. After authenticating with their identity provider, users are prompted for MFA. The [`CF_Device` cookie](/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/#cf_device) ensures both authentication steps occur on the same device. MFA session durations do not affect how long a user has access to the application (that is controlled by the [application token](#session-durations)).
If you use [independent multi-factor authentication (MFA)](/cloudflare-one/access-controls/access-settings/independent-mfa/), the MFA session duration determines how long a user can log in to Cloudflare Access without another MFA prompt. The MFA session is independent of the global, policy, and application session durations. The [`CF_Device` cookie](/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/#cf_device) binds the MFA session to the device where the user completed the challenge.

Access evaluates MFA only during the login flow. While the application session is active, Access does not check the MFA session or Authentication Method Reference (AMR) matching state. An expired MFA session does not interrupt access or expire the application token. When the application session becomes inactive, Access checks whether the MFA session is still valid. An application session can become inactive because it expired, the user logged out, or the user cleared their cookies.

The following table shows how application and MFA session durations affect the user experience:

| Application and MFA durations | Application session status | MFA session status | User experience |
| ----------------------------- | -------------------------- | ------------------ | --------------- |
| Application shorter than MFA (`1h` and `24h`) | Inactive | Active | Access login without an MFA prompt |
| Application shorter than MFA (`1h` and `24h`) | Active | Active or inactive | Direct access |
| Application equal to MFA (`24h` and `24h`) | Inactive | Inactive | Access login with an MFA prompt |
| Application equal to MFA (`24h` and `24h`) | Active | Active | Direct access |
| Application longer than MFA (`7d` and `1h`) | Active | Inactive | Direct access |
| Application longer than MFA (`7d` and `1h`) | Inactive | Inactive | Access login with an MFA prompt |

If the application session is longer than the MFA session, it determines how long the user retains access. Access prompts for MFA again only after the application session becomes inactive and the user starts another login flow.

### Order of enforcement

Expand Down
2 changes: 2 additions & 0 deletions src/content/docs/cloudflare-one/access-controls/policies/mfa-requirements.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,8 @@ To configure MFA for an infrastructure application policy, refer to [Infrastruct

The MFA session duration determines how long a successful MFA authentication remains valid. After the MFA session expires, the user must complete MFA again on their next Cloudflare Access login in addition to completing IdP authentication. You can require users to complete MFA on each Access login or set a custom duration. MFA session durations are only checked during the login flow and do not affect a user's existing session.

For examples, refer to [MFA session duration](/cloudflare-one/access-controls/access-settings/session-management/#mfa-session-duration).

Access checks MFA sessions from most specific to least specific:

1. **Policy MFA session duration** — If set, applies to users who match the policy.
Expand Down