Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

I see there is a way to skip consent with the Ory console: <https://www.ory.sh/docs/oauth2-oidc/custom-login-consent/flow#skipping-consent-for-trusted-clients>
Is there a configuration option for this in hydra (or oauth clients) that I'm missing?

or does this still take them to a consent flow but just not prompt them?

yes, you can set `skip_consent`  in the oauth2 client to true, then it will be skipped

<https://github.com/ory/docs/pull/1350/files>

Seems like it still forwards the request to the consent endpoint and that is used as a flag to skip the consent manually. Is there a reason it does it that way instead of just auto-accepting it in hydra itself to save on network traffic?

yes without it how would you set the accepted scope or audience etc?

wouldn't that all be in login request anyways? If consent is being skipped, couldn't it all that be grabbed from the login req and skip the extra step?

that would be a serious breaking change both in terms of API as well as conceptually. that’s why we don’t skip the redirect :slightly_smiling_face: