Setting device as remembered does not suppress MFA challenge

Do you want to request a feature or report a bug? Bug

Note: This issue has already been reported to Cognito Development team via support centre and it was suggested to create an issue on Github repo for SDK as well for monitoring.

What is the current behavior?

This issue occurs with the device that user uses to change the password at the first sign-in only. Marking that device as remembered (while MFA is enabled for that user) does not suppress the MFA challenge on next logins. User has to complete MFA challenge one more time while device is marked as remembered in order for it suppress MFA challenges on future logins. User pool settings are below:

a. MFA settings 
   Optional
b. Device Settings
  Remember Devices - User Opt-in
  Avoid MFA with Remembered devices - Yes.

This issue does not occur on any subsequent devices tracked by Congito. As mentioned above this is only for device used for password reset required scenario. Below is the screencast of this issue reproduction

Steps performed in screencast:

1. New user logs in (new user is required to change password)
2. User fills his info for password change (User is prompted for name only. Rest of the info is preconfigured programmatically)
3. User logs out -> logs in again and enables MFA for his verified phone number
4. User logs out and on next login is prompted for MFA code to login as expected
5. User logs out and on next login ticks the checkbox to set the device as remembered
6. User is prompted for MFA challenge upon which user’s device is marked as remembered (From AWS console it can be verified that there is only one device being tracked on which user initial sign-in password change was done and that is marked as remembered as well)
7. Log out and login again
8. User is prompted for MFA challenge Again!! Even though his device is marked as remembered and as per user pool configuration, user should not be asked for MFA challenge on remembered device

What is the expected behavior? Once device is marked as remembered, then it should not ask for MFA challenge on that device again.

Which versions of Amplify, and which browser / OS are affected by this issue? Did this work in previous versions?

• amazon-cognito-identity-js 2.0.3
• Issue is reproducible on chrome/firefox/safari (Did not test on any other browser)
• It does not work on previous versions either

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[ruiyang]

For people reaching here, the workaround is to call remembering the current device before calling the setting up mfa api.