Based on the provided knowledge sources, there are a couple of scenarios where a user might be sent to the

/ui/welcome

page in the Ory Account Experience: 1. By default, the Account Experience comes with a welcome screen that shows information about the current user's session. This screen is accessible at

/ui/welcome

. However, it's important to note that this screen is primarily meant for debugging purposes and can be disabled in the Ory Console [Ory Account Experience](https://www.ory.sh/docs/account-experience). 2. When using a custom domain with Ory, once the domain is active, the Ory Account Experience becomes reachable at

https://<your-custom-domain>/ui/welcome

[Custom Domains](https://www.ory.sh/docs/guides/custom-domains#waiting-for-propagation). 3. The welcome screen can be used as a default redirect URL after certain flows. For example, when using the

ory proxy

command, you can set a default redirect URL to `/welcome`:

$ ory proxy --project <project-id-or-slug> \        --default-redirect-url /welcome \        <http://127.0.0.1:3000> \        <https://ory.example.org>

This ensures that all redirects (e.g., after login) go to

/welcome

instead of

/

, unless you've specified custom redirects in your Ory configuration or via the flow's

?return_to=

query parameter [ory proxy](https://www.ory.sh/docs/cli/ory-proxy#redirects). It's worth noting that while the welcome screen exists, it's not typically a primary destination for end-users. In fact, you can toggle the "Enable the Account Experience welcome page" setting to hide this default "welcome" screen that isn't intended for end-users [Configure Ory to use your UI](https://www.ory.sh/docs/kratos/bring-your-own-ui/configure-ory-to-use-your-ui).

To disable the welcome screen in the Ory Account Experience, you can follow these steps: 1. Log in to the [Ory Console](https://console.ory.sh). 2. Navigate to your project settings. 3. Go to the "Branding" → "UI URLs" section. 4. Look for the "Enable the Account Experience welcome page" setting. 5. Toggle this setting off to disable the welcome screen. This information is based on the documentation provided in [Configure Ory to use your UI](https://www.ory.sh/docs/kratos/bring-your-own-ui/configure-ory-to-use-your-ui), which states: "You can toggle the "Enable the Account Experience welcome page" setting to hide the default "welcome" screen that isn't intended for end-users." By disabling this setting, you'll hide the welcome screen that is primarily used for debugging purposes and not intended for end-users.

Hmm, I do not have enough information to answer your question specifically about avoiding a 403 error when a logged-in user accesses the recovery URL with the welcome screen disabled. The provided knowledge sources don't contain direct information about this particular scenario. However, I can provide some general insights based on the available information: 1. The Ory Account Experience is the default user interface for self-service screens, including recovery. It's accessible at

<https://your-slug.projects.oryapis.com/ui>

[Ory Account Experience Overview](https://www.ory.sh/docs/account-experience). 2. You can customize the UI URLs for different flows, including recovery, in the Ory Console under Branding → UI URLs [Configure Ory to use your UI](https://www.ory.sh/docs/kratos/bring-your-own-ui/configure-ory-to-use-your-ui). 3. If you're using a custom UI, you might need to handle this scenario in your own implementation. You could consider redirecting already logged-in users to an appropriate page or showing a message that recovery is not needed for logged-in users. 4. If you're using the Ory Account Experience, you might want to reach out to Ory support for specific guidance on handling this scenario, as the provided documentation doesn't cover this particular use case. Remember, when implementing custom flows or handling edge cases like this, it's important to consider security implications and ensure that your solution aligns with best practices for identity management.