moai-security

name	moai-security
description	Auth0 security specialist covering attack protection, multi-factor authentication, token security, sender constraining, and compliance. Use when implementing Auth0 security features, configuring attack defenses, setting up MFA, or meeting regulatory requirements.
version	1.0.0
category	security
tags	["auth0","security","mfa","attack-protection","tokens","dpop","mtls","compliance","fapi","gdpr"]
updated	"2025-12-24T00:00:00.000Z"
status	active
allowed-tools	Read, Write, Edit, Grep, Glob, WebFetch, WebSearch, Bash

Auth0 Security Specialist

Comprehensive security skill for Auth0 implementations covering attack protection, multi-factor authentication, token security, sender constraining (DPoP/mTLS), and regulatory compliance (FAPI, GDPR, HIPAA).

Quick Reference

Security Feature Categories

Attack Protection:

• Bot Detection: CAPTCHA challenges for suspicious traffic
• Breached Password Detection: Blocks compromised credentials
• Brute Force Protection: Limits failed login attempts per account
• Suspicious IP Throttling: Rate limits high-velocity attacks

Multi-Factor Authentication:

• Push notifications via Auth0 Guardian
• One-time passwords (TOTP)
• WebAuthn with security keys and biometrics
• SMS/voice verification and Adaptive MFA

Token Security:

• JWT structure and validation
• Access token management with scopes
• Refresh token rotation and expiration
• Token revocation strategies

Sender Constraining:

• DPoP: Application-layer token binding
• mTLS: Transport-layer certificate binding

Compliance: FAPI, GDPR, HIPAA/HITECH, PCI DSS, ISO 27001, SOC 2

Dashboard Navigation

Attack Protection: Dashboard > Security > Attack Protection MFA Configuration: Dashboard > Security > Multi-factor Auth Security Center: Dashboard > Security > Security Center

Essential Setup Checklist

1. Enable Bot Detection with appropriate sensitivity
2. Activate Breached Password Detection
3. Configure Brute Force Protection thresholds
4. Enable Suspicious IP Throttling
5. Set up at least one MFA factor
6. Configure token expiration policies

---

Implementation Guide

Attack Protection

Bot Detection: Navigate to Dashboard > Security > Attack Protection > Bot Detection. Configure sensitivity (Low/Medium/High) and response type (Auth Challenge recommended, Simple CAPTCHA, or third-party). IP AllowList supports up to 100 addresses/CIDR ranges.

Supported flows: Universal Login, Classic Login, Lock.js v12.4.0+, native apps. Unsupported: Enterprise connections, social login, cross-origin authentication.

Breached Password Detection: Enable for signup and login. Response actions include blocking compromised credentials and user/admin notifications. Standard Detection has 7-13 months detection time; Credential Guard (Enterprise) reduces to 12-36 hours. Test with passwords starting with AUTH0-TEST-.

Brute Force Protection: Default threshold is 10 failed attempts (configurable 1-100). Protection mechanisms include IP-based blocking and account lockout. Blocks remove after 30 days, password change, admin removal, or user unblock link.