while updating password in the recovery flow, not always the user is redirected to the login page, which might lead to security issues. How can I make sure that user is always redirected to the login page before updating password.

See the explanation here: https://www.ory.sh/docs/guides/session-management/overview#privileged-sessions

thanks patrik