Capability

Bot detection

What it does: Stops scripted logins and credential stuffing before they reach accounts.

CIC

In short

Bot detection tells scripted sign-ins from human ones. When traffic looks automated, Auth0 can ask for a challenge before the request goes further. A person can complete the challenge, while a script usually cannot.12

Book a callHow Auth0 does it ↓
5
attack types it helps against

What it is, and the attacks it stops

Attackers rarely type passwords by hand - they run scripts that try many email and password pairs against a login page, a sign-up form or a password reset form.

Bot detection looks at the traffic reaching those pages. When it looks automated, Auth0 can require a challenge before the request goes any further. You enable and tune the protection per database connection, with limits that apply to each connection.13

That helps against attacks such as:

1

Credential stuffing

A script tries leaked email and password pairs on your login page, one after another, until some of them work.

2

Scripted sign-up abuse

Bots create fake accounts in bulk, which pollutes your customer data and can be used for fraud.

3

Password reset abuse

A script floods the reset form to send unwanted emails to customers or to probe which accounts exist.

4

Account enumeration

A script tries email addresses one after another to learn which ones have an account with you.

5

Slow scripts spread over many addresses

Attackers spread attempts over many addresses and over time, so that simple limits on one address do not catch them.

Before and after rollout

Without
With
WithoutScripts and people look the same to the login page.
WithTraffic that looks automated can be sent to a challenge.1
WithoutA script can try many credential pairs without anyone noticing.
WithSuspicious requests face a challenge before they can continue.1
WithoutFake sign-ups and unwanted reset emails create cleanup work for your team.
WithChallenges on sign-up and password reset flows can reduce that abuse.13
WithoutOne rule applies to every visitor, whether it is a person or a bot.
WithYou can set the sensitivity of the detection and choose which flows it covers.3

How Auth0 does it

Auth0 Bot Detection sits in front of sign-in flows and decides for each request whether to ask for a challenge.1

1

A request reaches a protected flow

A visitor submits a login, sign-up or password reset request.1

2

Auth0 assesses the traffic

Auth0 evaluates whether the request looks like it comes from a bot.1

3

A challenge may be required

When the traffic looks suspicious, Auth0 can present a challenge that a person can complete.13

4

Settings decide how strict this is

You configure the sensitivity and the flows covered, to balance protection against friction for customers.3

CIC
Who it protectsYour app's users
Bot DetectionAuth0 Attack Protection includes bot detection that can challenge traffic that looks automated.12
Configurable sensitivityYou can adjust how sensitive the detection is, so that you can balance protection against friction.3
Flow coverageYou can apply the protection to flows such as login, sign-up and password reset.3

How Zelto implements it

Auth0 provides the detection - Zelto works out with you which flows bots hit, how strict to be and how to keep genuine customers from being blocked. We plan the rollout in stages to minimize risk/impact, and we check the result with your own login pages and apps before we tighten anything.

Typical rollout

  1. Map which flows attract automated traffic

    We review your login, sign-up and password reset flows and the logs you already have.

  2. Choose the flows and the sensitivity

    We agree on which flows get a challenge and how sensitive the detection is, and who on your side owns those settings.

  3. Test with your own login pages and apps

    We check that the challenge works on the devices and browsers your customers use, including customers who rely on assistive technology.

  4. Switch on in stages

    We start with the flow that bots hit most. We watch how many customers get challenged before we raise the sensitivity.

  5. Review and adjust

    We review challenged and blocked traffic on a schedule, and we adjust the settings when customers or attackers change their behavior.

Pitfalls we plan for

The detection is set so strictly that customers keep getting challenged.

−Raise the sensitivity to the maximum on day one. Customers abandon the sign-in and support gets the complaints.

+Start at a moderate level, watch how many customers are challenged and raise the sensitivity step by step.

Bots hit a flow that nobody protected.

−Protect the login page only. Attackers move to sign-up and password reset.

+Review every flow that accepts an email address or a password, and cover the ones attackers use.

Attackers change their addresses and slow down.

−Rely on bot detection alone and assume the problem is solved.

+Combine it with IP throttling and breached password detection, so that each control covers what the others miss.

Customers use assistive technology or unusual browsers.

−Test the challenge only on the browsers your team uses, so some customers cannot complete it.

+Test on the devices, browsers and assistive tools your customers use, and agree on what happens when a customer cannot complete the challenge.

Want scripted logins to stop reaching your customer accounts?

We review where automated traffic hits your sign-in, sign-up and reset flows today. Then we tell you what to change first.

Book a call30 minutes, no slides. We look at your customer login flows today.

Sources

Official Okta and Auth0 documentation and primary legal sources.

  1. 1Bot detectionAuth0 Docs
  2. 2Attack protectionAuth0 Docs
  3. 3Update Bot Detection settings (Management API)Auth0 Docs