Security Questions

Security Questions are a knowledge-based authentication (KBA) that adds an extra layer of protection by verifying users through personal questions only they should know the answers to, such as "What is your mother’s maiden name?". This method is especially useful for scenarios like password recovery or step-up authentication when primary methods (like OTP via SMS or email) aren't feasible. LoginRadius allows you to configure custom questions, control how many are shown, and set limits on answer attempts, giving you flexibility to tailor the experience to your security requirements.

Key Features

LoginRadius Security Questions offer a set of features designed to enhance both user account protection and administrative control over how the feature is deployed:

• Custom Questions Configuration: You can create personalized security questions that reflect the needs of your user base.

• Multi-Question Support: Choose how many questions are presented to the user during authentication.

• Retry Limit Enforcement: Define how often a user can attempt to answer security questions before being locked out of the process.

• Console and Code Integration: Based on your development strategy, deploy the feature directly from the Admin Console or via the JavaScript SDK and API endpoints.

These capabilities work together to reduce the risk of unauthorized access and improve the resilience of your authentication process.

Business Use Cases

Security Questions can be applied in multiple customer identity workflows to increase confidence in user verification, especially when dealing with forgotten passwords or unusual sign-in patterns.

• Account Recovery: During password reset, Security Questions help confirm that the request is from the actual user and not a malicious actor.

• Step-Up Authentication: When combined with contextual or risk-based triggers (e.g., new device or location), Security Questions provide an extra hurdle before sensitive actions.

• Low-Tech Environments: In scenarios where users may not be able to access email or mobile devices, Security Questions provide a reliable fallback authentication method.

• Regulatory Compliance: Knowledge-based verification is sometimes mandated as part of identity verification for industries like healthcare, finance, and government.

Configuration

LoginRadius provides a flexible configuration experience through the Console, where administrators can define the questions and control how the feature behaves during authentication and recovery processes.

Console Configuration

1. Log in to your LoginRadius Console.

2. Go to Security > Security Question.

3. Click Add New Security Question to begin defining your custom questions.

4. Enter the security question text you want users to answer.

5. Save your settings to apply the question to your registration and recovery flows.

You can also adjust how many questions should be rendered to users and how many times they’re allowed to answer incorrectly during a password reset.

Settings Overview

These key settings are available to fine-tune how the feature works:

• Number of Security Questions to Render: Controls how many questions a user must answer during sign-up or recovery. For example, setting this to 2 means users must answer two separate questions.

• Security Question Attempt Limit on Reset Password: This limit restricts the number of incorrect answers a user can give when resetting their password. To prevent abuse, the reset process is blocked once the limit is reached.

JavaScript Library Integration

If you prefer to integrate Security Questions directly into your front-end flows, the LoginRadius JavaScript Library supports essential operations:

• Updating Security Question Answers: Enable logged-in users to update or change their existing answers.

• Resetting Password by Security Question: Allow users to recover their account by verifying the correct answers to their pre-set security questions.

Refer to our guide for implementation and example usage details: JavaScript Customization Guide – Security Question

Security Question API Integration

In addition to console-based and SDK-level setups, LoginRadius offers a set of dedicated API endpoints to help you manage security questions programmatically. These APIs allow you to retrieve, configure, and update user-specific security questions and answers, giving you more flexibility in integrating this authentication factor into your application workflows.

Configured Questions (Site-Level)

The security questions configured via the LoginRadius Console are stored as key-value pairs, with each question assigned a unique QuestionId. You can retrieve these using:

• Account Get Configurations API: Returns the site configuration, including all defined security questions and their QuestionIds.

Sample response:

{
  
  "SecurityQuestions": {
    "Questions": [
      {
        "QuestionId": "2acec20722394dc3bd6362ef27df824e",
        "Question": "What is your favourite donut?"
      },
      {
        "QuestionId": "5ea913df084b4dbcb3100820769e8d1a",
        "Question": "What's your first job?"
      }
    ],
    "SecurityQuestionCount": 2
  }
  
}

User-Specific Security Questions

To access security questions associated with a specific user, you can use any of the following endpoints:

• By Access Token: Retrieves a user's configured security questions using their active access token.
• By Email: Retrieves a user's security questions based on their registered email address.
• By User Name: Retrieves a user's security questions using their unique username.
• By Phone ID: Retrieves a user's security questions based on their registered phone number.

Example response:

[
  {
    "QuestionId": "0a67b****343fdab*****fe9a5c16b",
    "Question": "what is your middlename?"
  }
]

Update Answers via Access Token

• Update Security Question by Access Token: This API is used to update security questions by the access token.

Payload format:

{
  "securityquestionanswer": {
    "abcd1234abcd1234": "Answer"
  }
}

Note: This only updates the answer to an already configured question and does not register a new question for the user.

Add or Update User Questions

• Account Update Security Question Configuration: Use this API to assign answers to new security questions for a user—particularly helpful when the questions were introduced after the user’s initial registration and setup.

Related Resources

Explore additional documentation to extend further or enhance your use of Security Questions:

• Multi-Factor Authentication
• Risk-based/Adaptive Authentication
• Session Management
• Customer Identity APIs