Bot Detection

Bot detection mitigates scripted attacks by detecting when a request is likely to be coming from a bot. These types of attacks are sometimes called credential stuffing attacks or list validation attacks. It provides protection against certain attacks that adds very little friction to legitimate users. When such an attack is detected, it displays a CAPTCHA step in the login experience to eliminate bot and scripted traffic. Download this free whitepaper to learn how Auth0 can help you combat credential stuffing attacks.

Auth0 uses a large amount of data and statistical models to identify patterns that signal when bursts of traffic are likely to be from a bot or script. Users who attempt to log in or create accounts from IPs that are determined to have a high likelihood of being part of a credential stuffing attack will see a CAPTCHA step. The triggers are designed so that this only happens for bad traffic; the objective is to not show any friction to legitimate users.

Attack Protection - CAPTCHA Login Screen Example

This protection is enabled by default for all connections.

Go to Auth0 Dashboard > Security > Attack Protection, and select Bot Detection.
Under Detection, enable the toggle.

Enabling attack protection features without configuring response settings activates Monitoring mode, which records related events in your tenant log only. The tenant log will contain information about whether the login was determined to be risky so you can determine if you want to configure responses.

If you cannot see the toggle to enable this feature, you may need to upgrade your plan.
Under Response, choose when you want to require CAPTCHA.
1. Choose Never to never require your users to complete a CAPTCHA to log in.
2. Choose When Risky to only require your users to complete a CAPTCHA if the login appears to be high risk. Select the type of CAPTCHA in the next step.
3. Choose Always to always require your users to complete a CAPTCHA to log in. Select the type of CAPTCHA in the next step.
Choose whether you wish to use simple CAPTCHA provided by Auth0 or Google reCAPTCHA (requires external setup and registration).
1. If you choose Simple CAPTCHA, you are done.
2. If you choose Google reCAPTCHA, enter the Site Key and Site Secret that you obtained when you registered your app with Google.
  
  Auth0 does not support Google reCAPTCHA Enterprise.
Click Save.

Bot protection works for web and mobile apps that use Auth0 Universal Login. For experiences that do not use Universal Login, levels of support are limited, in particular for flows that cannot support a CAPTCHA challenge. Please ensure all of your login experiences are supported before turning on this feature, or you may introduce errors into your application.

Flow	Limitation
New Universal Login	Supported by default.
Classic Universal Login (no customizations)	Supported by default.
Classic Universal Login (custom login page using Lock template `lock.js` widget)	Supported if using Lock version 11.29 or greater of Auth0’s Lock widget. Please ensure you have followed all the steps to add bot detection to custom pages.
Classic Universal Login (custom login page using Custom Login Form template `auth0.js` widget)	Supported if using `auth0.js` version 9.14 or greater to build custom login pages only if you enhance your code to handle a CAPTCHA challenge. Please ensure you have followed all the steps to add bot detection to custom pages.
Classic Universal Login (custom login page using Passwordless template)	Not supported.
Web or native apps using Resource Owner Password Flow (including those using `lock.android` and `lock.swift` SDKs)	Not supported.
Native apps using newest version of SDKs	Supported. The SDKs handle a risky login by invoking the Universal Login flow.
Flows not hosted by Auth0 using `lock.js`, `auth0.js` which perform cross-origin authentication (`co/authenticate` endpoint)	Not supported.

Depending on the types of connections you use, bot detection has the following limitations.

Connection Type	Limitation
Database connections Custom database connections Active Directory/LDAP connections	Supported if the login uses a compatible login flow as described in the table below.
Enterprise connections Social Login Passwordless connection	Not supported.

If you build a custom login page using auth0.js, you can enable bot detection to render a CAPTCHA step in scenarios when a login request is determined by Auth0 to be high-risk. Your custom login form code must handle scenarios where the user is asked to pass a CAPTCHA step.

If you build native applications using an Auth0 SDK for the login flow, you can enable bot detection to render a CAPTCHA step in scenarios when a login request is determined by Auth0 to be high-risk. Your custom login form code must handle scenarios where the user is asked to pass a CAPTCHA step.

Docs

Bot Detection

Bot Detection

Configure bot detection

Restrictions and limitations

Flow limitations

Connection type limitations

Native application support

Keep reading

Was this article helpful?

Bot Detection

Configuration

Bot Detection

Configure bot detection

Restrictions and limitations

Flow limitations

Connection type limitations

Custom login page support

Native application support

Keep reading

Was this article helpful?