Question about login webhook behavior and identity...
# ory-selfhosting
m
Question about login webhook behavior and identity metadata persistence when using Kratos self host (1.3.10 I'm using a login post-hook webhook that responds with identity.metadata_public changes, but I'm seeing what may be an inconsistent behavior (Or is this expected behaviour) During login flow: The webhook response shows the metadata is applied (visible in login response), i.e. after posting to self-service/login?flow=XXX
Copy code
{
    "id": "1e4ec88b-0ec5-4e15-a9dd-348b8a638866",
// Snip for brevity
    "identity": {
        "id": "bf29640c-7a44-4421-940c-e10f041e05bd",
        "schema_id": "default",
        "schema_url": "<https://accounts.testing.local/auth-local/schemas/ZGVmYXVsdA>",
        "state": "active",
        "state_changed_at": "2025-05-23T06:46:43.07378Z",
        "traits": {
            "name": {
                "last": "McKee",
                "first": "AJ"
            },
            "email": "aj.mckee@testing.local"
        },
        "metadata_public": {
            "foo": "bar" // This is in the login response
        }
    },
// Snip for brevity
}
After login: sessions/whoami, the response doesn't include the metadata changes that are applied during the login. My webhook config:
Copy code
after:
    password:
      hooks:
        - hook: web_hook
          config:
            url: <http://host.docker.internal:8080/api/v1/webhook>
            method: POST
            can_interrupt: true
            response:
              parse: true
              ignore: false
Webhook response:
Copy code
{
  "identity": {
    "metadata_public": {
      "foo": "bar"
    }
  }
}
Questions: 1. Is this the expected behavior for login post-hooks? 2. Should login webhooks be able to persist metadata_public changes to the database? 3. If not, what's the recommended approach for dynamic metadata that needs to be available in sessions/whoami? Currently, it seems like the webhook only modifies the session identity in-memory during the login flow, but sessions/whoami fetches fresh identity data from the database.