Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

What's the proper way to persist the consent `Session` when using "Remember"/Skip? The login_session_id on the ConsentRequest is different from the originally authorized one.

1. Login with remember = false
2. Give consent with remember = true and some session data. There's now 1 consent session for the subject with login_session_id = ""
3. Login again with remember = true
4. Consent screen is properly skipped. 
5. There's still only 1 consent session for the subject with login_session_id = ""
That means that I cannot use the "list consent session for a subject with the login_session_id parameter" API endpoint

Right now, when ConsentRequest.Skip is true, I just list all the consent sessions for the subject and pick the first one for ConsentRequest.ClientID to get the original session data to set, but that feels bad.

I think this is a bug. Someone else asked the same question:

<https://github.com/ory/hydra/discussions/3301>