Diagnosing Ory Kratos Self‑Service Flow Errors: CSRF, Expiry, and Redirect Loops
Guide to diagnosing CSRF, expiry, and redirect loop errors in Ory Kratos self‑service browser flows.
Loading…
ReadMeFeed / Community knowledge
Ory
Real questions. Useful conversations. Find the people who know your stack.
Ory
Security & identity · #ory
Centralized API Access Control with Ory Oathkeeper and OPA Rego Policies
Microservices often duplicate auth logic, leading to inconsistency and maintenance overhead. Ory Oathkeeper can delegate authorization decisions to OPA’s Rego engine, providing a central, policy‑driven access control layer.
Diagnosing Ory Kratos Login Failures: The invalid_credentials Error
A diagnostic checklist for Ory Kratos self-service login failing with invalid_credentials: read the debug logs, verify the identity and schema identifiers, check the password hasher config, and rule out cookie domain issues.
Implementing Fine-Grained Access Control with Ory Keto
Decouple authorization from your code using Ory Keto's relation-based access control (ReBAC). Learn how to use relation tuples and the Check API to manage fine-grained permissions.
Troubleshooting Ory Kratos Email Verification Failures
Diagnose and fix email verification failures in Ory Kratos. Learn how to troubleshoot SMTP misconfigurations, schema errors, and network blocks to ensure users receive registration emails.
Validating OAuth 2.0 Access Tokens with Ory Hydra's Token Introspection Endpoint
Learn how to validate OAuth 2.0 access tokens using Ory Hydra's token introspection endpoint, including prerequisites, request format, response checks, and recovery steps.
Stop Building Custom Password Reset: Ory Kratos Recovery Flow Does It Declaratively
Kratos provides a declarative, self-service account recovery flow that eliminates custom password reset code. Two strategies (link or code), single-use tokens, automatic session issuance — all configured in YAML. Here's how to adopt it and where the limits are.
Ory Oathkeeper Rule Ordering: Why Your JWT Rules Silently Fail
Ory Oathkeeper stops at the first matching access rule and never hot-reloads file-based config. Learn how rule ordering, case-sensitive JWT claims, and restarts cause silent routing failures — and how to verify which rule actually fired.
One JSON Schema to Rule Your Identity Traits: Ory Kratos's Identity Schema in Practice
Ory Kratos uses one JSON Schema document as the source of truth for identity traits, driving both server-side validation and self-service form rendering. Here's how it works, with a worked example and the migration trap to avoid.