I'm experimenting with kratos as a login/registration system and I noticed that even the self-service UI seems to redirect to the init flow endpoint rather than calling the endpoint directly - is that on purpose? Wouldn't that allow a user to intercept the redirect url and replace some of the query params? Or would it be better to just use the API client flows?

Yes - we need to prepare the login and protect against csrf and other attack vectors!

Right, I understand the CSRF vector - what I'm thinking of is: couldn't someone take the redirect URL and (as an example) replace or drop the aal param, so it would return to the application as a successful login, but wouldn't have the requested assurance level?