Preflight checklist
Ory Network Project
No response
Describe your problem
It would be useful to be able to modify some/all of the session data passed to a flow-interrupting webhook.
My immediate need is to have variable session duration based on business logic. For example, different session durations for different user roles. I see that Ory Enterprise allows organisations to have different session times. This is not exactly what I need, but shows that the building blocks for dynamic session lifetime are there in Kratos. I would like this to be available to webhooks.
This could also be useful for updating the location of a session device, in the case that Kratos is not being proxied behind CloudFlare. A webhook could use a GeoIP library to perform a lookup and update the location information back to Kratos.
Having experimented with webhooks, and inspected the code, it looks as though flow-interrupting webhooks can only update properties of the Identity. It would be great if the session could also be modified.
Describe your ideal solution
A flow-interrupting webhook (such as after login) should be able to return a partial session object to provide updates to Kratos. For example, a webhook could dynamically change the session expiry by returning that value:
let sessionExpiry: Date;
// if the identity is marked as an admin user in metadata_public, they get
// a 1 hour session lifetime
if (ctx.identity.metadata_public.admin) {
sessionExpiry = add( new Date(), { hours: 1 } );
}
// regular users get a 30 day session
else {
sessionExpiry = add( new Date(), { days: 30 } );
}
// we return the updated session lifetime in the response from the webhook
return {
session: {
expires_at: sessionExpiry.toISOString();
}
}Workarounds or alternatives
The only alternative I can see is that our API checks the session age whenever a request is made to it. If the business logic says that the session should be expiries, then it uses the Kratos Admin API to delete the session, and 401 the client's request.
Unfortunately, that still means that Kratos considers it an active session until a request to our API has occurred. This would make it possible, for example, to complete Kratos Settings flows, etc.
Version
26.2.0
Additional Context
No response
Preflight checklist
Ory Network Project
No response
Describe your problem
It would be useful to be able to modify some/all of the
sessiondata passed to a flow-interrupting webhook.My immediate need is to have variable session duration based on business logic. For example, different session durations for different user roles. I see that Ory Enterprise allows organisations to have different session times. This is not exactly what I need, but shows that the building blocks for dynamic session lifetime are there in Kratos. I would like this to be available to webhooks.
This could also be useful for updating the location of a session device, in the case that Kratos is not being proxied behind CloudFlare. A webhook could use a GeoIP library to perform a lookup and update the location information back to Kratos.
Having experimented with webhooks, and inspected the code, it looks as though flow-interrupting webhooks can only update properties of the Identity. It would be great if the session could also be modified.
Describe your ideal solution
A flow-interrupting webhook (such as
after login) should be able to return a partial session object to provide updates to Kratos. For example, a webhook could dynamically change the session expiry by returning that value:Workarounds or alternatives
The only alternative I can see is that our API checks the session age whenever a request is made to it. If the business logic says that the session should be expiries, then it uses the Kratos Admin API to delete the session, and 401 the client's request.
Unfortunately, that still means that Kratos considers it an active session until a request to our API has occurred. This would make it possible, for example, to complete Kratos Settings flows, etc.
Version
26.2.0
Additional Context
No response