ory / ory/network

OAuth2 Clients with the "skip consent" flag fail to execute `prompt=none` flows

Open
#317 7 comments 0 reactions 1 assignee View on GitHub

@hperl is already working on this.

Since Jul 6, 2023.

bug
Dominant language
Shell
Stars
96
Forks
8
PR merge metrics
No merged PRs in 30d

Description

Preflight checklist
Describe the bug

OIDC clients, that have "skip consent" setting enabled, fail to find a previous suitable consent, and instead silently create a new one. This does not make the consent UI pop-up, but fail prompt=none auth requests with consent_required error. Explicitly remembered consents do not have this problem.

The problem is that skip consent is only used in the UI and is not respected in the "find previous consent" logic in Ory Hydra.

Reproducing the bug
  1. Create client with skip consent flag set to true
  2. Perform oauth2 flow with prompt=none
  3. Get consent_required error
Relevant log output

No response

Relevant configuration

No response

Version

master

On which operating system are you observing this issue?

None

In which environment are you deploying?

None

Additional Context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.