Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hi there, I hope this get's answered because a lot of questions seems to just get ignored.. but here we go.
I just read on a thread on github (<https://github.com/ory/hydra/issues/1943>) that the login app is not supposed to have a session. I was not aware of this.. I didn't see it in the docs. So now I'm looking to remove it from the app we're building. For reference, we are using Hydra with a in house Identity Service. So it seems like the Login/Consent Applications are supposed to be separate from the IdP? Is this correct?

Also, looking at Kratos for an example.. it seems to have the login app built into it? (<https://github.com/ory/kratos/blob/master/selfservice/flow/login/handler.go#L388>)  but I'm not seeing any reference to the consent. So I'm confused as to what approach I'm supposed to take.

I see the point that it is hard to manage a session on the login app because there could be a conflict between already having an existing session and what the LoginRequest Skip param tells you to do