Skip to content

Commit e1d51ad

Browse files
committed
docs: simplify trusted device cookie guidance
1 parent 2be33fd commit e1d51ad

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

docs/end-user-flows/mfa/trusted-devices.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,11 @@ On the page, users can choose:
3737
When a user selects **Skip**, Logto stores a separate opt-out cookie scoped to that tenant and user in the current browser. Its lifetime is the configured trust duration at the time of skipping. While the browser retains this cookie, later sign-ins do not show the page again. After it expires or is cleared, a later eligible flow can show the page again. The opt-out cookie does not grant device trust or fulfill MFA.
3838

3939
:::tip Trusting the device after selecting Skip
40-
If a user selects **Skip** and later wants to trust the current browser, the recommended approach is to delete the corresponding opt-out cookie for the Logto domain using the browser's cookie settings or developer tools. Its name starts with `logto-device-trust-opt-out-`, prefixed with `__Host-` in production.
40+
If a user selects **Skip** and later wants to trust the current browser, the recommended approach is to delete the corresponding opt-out cookie for the Logto domain using the browser's cookie settings or developer tools. Its name starts with `__Host-logto-device-trust-opt-out-`.
4141

42-
Alternatively, clear all cookies for the Logto domain. This also removes other Logto cookies and may sign the user out.
42+
Alternatively, clear all cookies for the Logto domain.
4343

44-
After either option, sign out if needed and sign in again, complete eligible MFA verification or setup, and choose **Trust this device for N days** when the page appears.
44+
After either option, sign in again, complete eligible MFA verification or setup, and choose **Trust this device for N days** when the page appears.
4545
:::
4646

4747
Trusted-device creation and post-sign-in metadata updates are best effort, so a failure does not fail an otherwise successful authentication interaction.

0 commit comments

Comments
 (0)