I would like to use the SettingsFlow to update a users password. When I try I get the following Error: “The login session is too old and thus not allowed to update these fields. Please re-authenticate.” What is the correct way to re-authenticate? Like I said: I’m using the kratos-client SDK for Typescript in react-native and react-native-web.

You can set

privileged_session_max_age

to something really low so that actions like this that require a privileged session will ask the user to give their password/authenticate again if they haven’t just logged in.

My current problem is, that I am past the max age but don’t know how I tell Ory to re-authenticate the user.

We're using the kratos-client SDK and when we hit this error this is what we do. When we get the message

The login session is too old and thus not allowed to update these fields. Please re-authenticate

there is a

redirect_browser_to

parameter defined in the flow with a URL to our selfservice login. The URL also has a query parameter to refresh the session (re-authenticate) as well as a

return_to

URL so it returns to the settings flow/page. The

redirect_browser_to

URL looks something like this

<https://localhost/auth/self-service/login/browser?refresh=true&return_to=https%3A%2F%2Flocalhost%2Fauth%2Fself-service%2Fsettings%3Fflow%[uuid]>

. The login flow that we get back once the redirect has happened re-authenticates the user and then takes them back to the settings flow. The login flow has a message defined that the user needs to re-authenicate to carry out the action.

Hi @ancient-judge-84558 You can force the user to re-auth using the

refresh=true

query parameter. This is only applicable when the user already has a session. https://www.ory.sh/docs/kratos/bring-your-own-ui/custom-ui-advanced-integration#refreshing-user-session

@important-fall-74969 Thanks for your idea, but it’s not the process/flow we would like to follow. We rather want a single UI, where the user enters current and new password and it is changed for the user.

Would love to hear how you solved it! ☺️

Great you figured it out @ancient-judge-84558 Let me know if I can support with the writeup, maybe we can even publish a small blogpost about your usecase if you want.

Sorry, that it took a little white. So here is what I did. I created a static UI with two fields and a button (old password, new password and submit) I start two flows: 1. A LoginFlow with refresh=true 2. A SettingsFlow When the users submits, I transfer the csrf_token field and the identity field from the initialised LoginFlow to an updateLoginFlowBody and do the update. After that I copy the csrf_token from the initialised SettingsFlow to an updateSettingsFlowBody, add the new password and call update SettingsFlow. In the native version, I don’t need to copy over the csrf_token but use a session token instead.