Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hello again Oryers! I have yet another question, this time Kratos-related:

We are using the after login webhook (interrupting, for validation purposes). Now I've recently seen some requests where the `login.Flow.Active`  is unset, and thereby omitted. I'm not sure how a flow can get into a state where the CredentialsType is not set, particularly since this is in the "after" hook - but it results in the jsonnet parser failing because the field does not exist (in the json body that is, it's annotated with omitempty).

So, 1: How can a login flow even get into a state where there is no credentials type?
and 2: Is the entire field meant to be optional, since it's 'omitempty'?

For clarification, we use that field in our validation logic, since there are different things to validate depending on what login type is used :slightly_smiling_face:.