ORY Hydra CSRF Cookies

[borchero]

I was wondering why ORY Hydra sets the oauth2_authentication_csrf and oauth2_consent_csrf cookies. Since it does not implement the login and consent endpoints (and there are no POST requests reaching ORY Hydra), what is the point of these?

Thanks for your help :)

[Benehiko]

Hi @borchero,

Sorry for the late reply! 😓

Please check out this page on our documentation https://www.ory.sh/hydra/docs/debug/csrf
Let me know if that clears things up a bit 😄

[vinckr]

Hey @borchero,
Just checking in if your question was answered or if there was still something unclear.
I will mark this as answered for now.

[borchero]

Hey @vinckr, sorry for not following up on the provided answer. The linked page doesn't immediately answer why the CSRF token is set in the first place (only that CSRF is a "common pitfall"). By now it makes sense but young me didn't understand it when first reading through it 😄

[vinckr]

No problem @borchero, we all have many things to take care of, thanks for coming back to this!

By any chance to you have any idea how we could improve this section of the docs or could you give me some pointers as to what changed in your understanding of the issue?