Handling challenges in DFP Protected Auth
DFP Protected Auth allows you to confidently screen out bad actors from your authentication through Device Fingerprinting (DFP). DFP identifies bad actors using a variety of fingerprinting techniques.
While Device Fingerprinting is always confident that BLOCK are known instances of clients obscuring their requests, the service has instances where it isn’t confident if the request is malicious and it returns a CHALLENGE verdict.
What is a challenge verdict?
A CHALLENGE verdict is an interest where our DFP product notices something that is unusual with a request. It’s not a clear indication of impersonating a user like browser automation, but instead something that our DFP product thinks is suspicious; for example, the request is from an AWS datacenter IP. As a result, how you want to handle the request depends on your risk profile.
Challenge verdicts in DFP Protected Auth
Once you turn on Enforcement mode for Protected Auth, it handles CHALLENGE verdicts by treating them as ALLOW verdicts. For increased security, you can change the Protected Auth behavior in the Stytch SDK Configuration to either BLOCK those requests or TRIGGER_RECAPTCHA on a CHALLENGE verdict.
Running CAPTCHA on a CHALLENGE verdict
Stytch offers an SDK integration with Google Invisible reCAPTCHA that runs before an SDK method call. Invisible reCAPTCHA is a type of CAPTCHA that evaluates traffic without ever disrupting the user experience (hence the invisible part). When reCAPTCHA is configured and a user calls an SDK method, the SDK runs a CAPTCHA to get a captcha_token that gets forwarded with the SDK request. The Stytch backend calls the Google API on your behalf and returns an error if the reCAPTCHA doesn’t meet a threshold.
When Protected Auth is turned on Enforcement mode, the SDK won’t use reCAPTCHA by default. If CAPTCHA is configured in the Dashboard, the SDK can be configured to trigger reCAPTCHA on a CHALLENGE verdict. In this case, when Stytch receives a request with a CHALLENGE verdict, it will fail the request saying that a CAPTCHA token is required. The SDK will automatically retry the request but also include a captcha_token in the request. This allow users to have confidence that these CHALLENGE verdicts have enough friction to stop bad actors from trying to access their site.
What's next
To enable Device Fingerprinting Protected Auth, please contact support with the button below:
Contact sales