Native recovery flow error with code strategy

[NiteArie]

Hi there,

I'm currently using the new code strategy for account recovery. I confirmed that I have upgraded to using Kratos v0.11 with the new v1.1 JavaScript SDK.

I'm initializing the flow using createNativeRecoveryFlow and successfully in getting the code from the email after using the method updateRecoveryFlow.

The problem here is I can't complete the recovery flow with the code that I got from the email, on submission I called

updateRecoveryFlow({
      flow: flow.id,
      updateRecoveryFlowBody: {
        method: 'code',
        email,
        code,
      },
    })

With the flow.id being the flow that was initialized before
I got back this error insteading of completion:

{
 error: {
    id: 'browser_location_change_required',
    code: 422,
    status: 'Unprocessable Entity',
    reason: 'In order to complete this flow please redirect the browser to: http://127.0.0.1:3000/recovery?flow=fb058b5f-43d3-435d-b5d0-bd01a93968ac',
    message: 'browser location change required'
  },
  redirect_browser_to: 'http://127.0.0.1:3000/recovery?flow=fb058b5f-43d3-435d-b5d0-bd01a93968ac'
}

Am I doing something wrong in the process of recovering or this isn't supported? Thanks for the answer in advance.

[nicolasburtey]

I'm having the same issue

[nicolasburtey]

it seems the email should not be here? #2923

[NiteArie]

@nicolasburtey Yeah removing the email from the body doesn't solve the issue. The error is still the same.

[vinckr]

Can you please confirm it is also not this:

Copying the recovery code from the email included a leading space. After trimming the input, the account recovery was successful.

[NiteArie]

@vinckr Yes. I have thoroughly check my code and read all the issues/discussions related to the recovery process to not make this mistake.

[micheljung]

To reproduce:

domain=example.com

# Init flow
actionUrl=$(curl -s "https://$domain/self-service/recovery/api" | jq -r .ui.action)

# Request code
curl -X POST -H "Content-Type: application/json" -d '{"email": "[email protected]", "method": "code"}' "$actionUrl"

# Submit code (added 'Accept: application/json' according to https://www.ory.sh/docs/reference/api#tag/frontend/operation/updateRecoveryFlow)
curl -i -X POST -H "Content-Type: application/json" -H "Accept: application/json" -d '{"code": "467404", "method": "code"}' "$actionUrl"

Response:

HTTP/2 422
cache-control: private, no-cache, no-store, must-revalidate
content-type: application/json
date: Thu, 29 Dec 2022 11:36:50 GMT
set-cookie: csrf_token_5c349d55abcda945dde7b96dc14a4105480ede67710fc0f844c0b2ab2b2ff947=LaacqKcqU+nCUdC9mylMGbpy4fYv6KATMUlLzS0W5D4=; Path=/; Domain=REDACTED; Max-Age=31536000; HttpOnly; Secure; SameSite=Lax
set-cookie: ory_kratos_session=MTY3MjMxMzgxMHxSRnNoYU43UVVNRXI4NnJmb000V0JsYVBKTXZxOEZvbUhTZ3JWVWM1ZWVwVU45Rm5rbzB3dmJMZGExR0J5UkNpX0xkMWtyc2dKSXdMbWNFUmlmYndGbGVXeGUtbm5LTXJ1RnJUODVDdTRINC1ta19EbFB6TXFNYVlnbG9JeGpTZDdfWGtxak9RXzZidEZ5U01lZHBjcVh0ZUU1YTJPdHZnVXRZNVF3bnQwVVNEM0VkdHd2QU9iSmRSNTBYemdZMHpFdFY0SW1NaWY0eV8yVnVZTEh0U052STBLSEpLdnktNHdxV1hac1NQdkNUZFFNR29oazlJZVpPS1NHWTIxT1M4REc2UXBJR2hYVnJ1fDKie2-H449tft8Pxflm39sJjQg3yQU-7mEzk0znB749; Path=/; Domain=REDACTED; Expires=Fri, 30 Dec 2022 11:36:49 GMT; Max-Age=86399; HttpOnly; Secure; SameSite=Lax
vary: Cookie
content-length: 414

{"error":{"id":"browser_location_change_required","code":422,"status":"Unprocessable Entity","reason":"In order to complete this flow please redirect the browser to: https://REDACTED/settings?flow=fa8b0aaa-5ffe-445b-9ef8-d7e594c8a63b","message":"browser location change required"},"redirect_browser_to":"https://REDACTED/settings?flow=fa8b0aaa-5ffe-445b-9ef8-d7e594c8a63b"}

[staklau]

New Ory Network user here, and I'm having the same issue but with createBrowserRecoveryFlow.

[jonas-jonas]

Hi all!

Sorry for the confusion on this topic. The current state of the recovery flow does not support native apps. There are multiple reasons for this:

• There currently is no good way (in Kratos) for redirecting users to a different flow (type), but the current implementation requires the use of the "Settings" flow. That's why you're seeing the browser_location_change_required error. There is an open issue in which we track the implementation of that Design Doc: Common framework for state transitions on native/spa/web clients #2884
• On the other hand, the current implementation of the recovery flow requiring the "Settings" flow is not optimal, and there have been discussions on whether to make the Recovery flow "self-contained" by allowing users to re-set their password entirely inside the flow (making the requirement to redirect to another flow obsolete), but that requires a thorough technical design as it needs to be sufficiently secure!

Lastly, the documentation on the recovery flow has just been reworked, but we failed to include any warnings on this incompatibility, sorry about that.

As a workaround, you can implement the recovery flow using a browser window in your app. We know that this is not optimal, and have been thinking about how to solve it for a while, but are also busy with other, pressing things.

[mk1020]

@vinckr we're using Ory Network. Thank you!

[mk1020]

We are using react native and we are facing a problem where we cannot finish the password recovery flow. I get a code emailed to me but when I enter the code, instead of a successful response I get a browser_location_change_required error. I have tried different ways but nothing works, i also tried using webview but the user experience is very bad. Also, you have a repository called kratos-selfservice-ui-react-native, but password recovery doesn't work there either.

[nicolasburtey]

facing same problem here

[nicolasburtey]

in case you were able to solve the problem, let me know @mk1020

[jonas-jonas]

Please see #2959 (comment) for an updated answer.

[nicolasburtey]

actually I made it working with kratos v1 but can't make it work with kratos v1.1

I guess we'll wait until createNativeRecoveryFlow is properly implemented

[jonas-jonas]

Please see #2959 (comment)

[jonas-jonas]

Some time has passed since my initial comment (#2959 (comment)).

We have since implemented a fix for the issue here #3624. The way to enable it, is to add the following to your config:

feature_flags:
  use_continue_with_transitions: true

After setting that, instead of returning a browser_location_change_required error, Kratos should return a reference to the settings flow, that the user should then use to update their password.