Ory Kratos SQL Restore and Identity State Consistency

Identity Store Restoration

In a self-hosted Ory Kratos deployment using a SQL database (PostgreSQL, MySQL, or SQLite), disaster recovery typically involves importing a database dump or snapshot to a new instance. This process restores identities, credentials, traits, and the current state of verification and recovery flows.

Consistency Constraints

A point-in-time restore may result in a mismatch between the restored identity records and the actual state of external communication. Specifically, verification links, recovery tokens, and active sessions stored in the database are restored to their state at the time of the backup, regardless of whether those tokens have since expired or been invalidated in the real world.

It is unclear if Kratos implements any automatic revalidation or invalidation logic for these transient states upon startup following a database restoration, or if the system treats the restored state as current and valid.

• Does Ory Kratos automatically invalidate pending verification and recovery challenges after a database restore?
• Are active sessions restored from the SQL store treated as valid regardless of the time elapsed since the backup was taken?