Hi
I found a stackoverflow answer from 2019.

"FusionAuth does not currently limit the number of active sessions a user may have in your application or in our SSO"

Is this still the same? Any plans for this feature?

We also noticed that even with silent renewal, MFA code is getting triggered. This is very annoying for our users who stay on the page for long time.

Is there a way prevent MFA for SPA on every token refresh?

@dan We have the exact problem.

MFA prompt is ruining the SSO experience.

Can you please share which cookie is supposed to handle the MFA trust.

Hi

We have a react application using OIDC for authentication. We enabled MFA for the application.

Whenever user refreshes page, user is forced to enter MFA one more time.

Is it expected behavior?

On searching, I found on github https://github.com/FusionAuth/fusionauth-issues/issues/1704

Can you please let us know if there is any workaround to avoid getting MFA page within same session.

@dan

These webhooks are often ingested into a SIEM

This is one use case. Agreed.

There might be some applications where UI has to update based on user actions related to MFA on fusionauth pages.

We are using some work arounds for now. But, I think without these webhooks, MFA is incomplete feature.

Should not the web hooks for MFA be part of MFA feature?

@dan Do you have any plans to give preference in community support for starter plan users?

Some kind of badge to prioritise responding to starter plan users?

@alickabrook1
I was not setting origin URL in mobile app.

I was setting it in fusionauth config.

Shared screenshot in https://github.com/FusionAuth/fusionauth-issues/issues/1443

Hi

We have a feedback from security expert.

When we signup with an email on registration page, page behaves differently when the email already exists. This gives information to attacker to filter out which emails exist.

Is it possible to configure the UI to behave similarly irrespective of whether email already exists or not. But, no verification email goes out if the email already exists.

Hello,

It's been a while.

Is it something that can be planned in future?

Hi @joshua

I can confirm fusionauth is using deprecated javascript library.

I wrote my analysis here https://github.com/FusionAuth/fusionauth-issues/issues/1939

Can you please release a patch for updating the code.

Thank you.