Session refreshing on user login

[kaboomdev]

Hi Ory team,
First of all, thank you for the great product!

We are facing an issue when a logged in user requests the self-service login flow with the refresh query parameter.
Here is a piece of the error response:

{
  ...
  "oauth2_login_challenge": null,
  "refresh": true,
  "request_url": "{domain}/self-service/login/browser?refresh=true",
  "requested_aal": "aal1",
  "type": "browser",
  "ui": {
    "action": "{domain}/self-service/login?flow=a842ce5f-b4a5-48b7-96dd-34ac1edd0aab",
    "messages": [
      {
        "id": 4000001,
        "text": "A valid session was detected and thus login is not possible. Did you forget to set '?refresh=true°?",
        "type": "error"
      }
    ]
  },
  "method": "POST",
  ...
}

The error message recommends to add the refresh query parameter, however it is already there.

Following the session refresh logic, we understood that this request will not log the user out (info here) as well as not take into account the existing session of user. Thus, on each request with the refresh param, we are awaiting to receive a login flow independent of the current session. Is this a misconception or a bug?

As a working solution, we are currently logging the user out before requesting the login flow.

[vinckr]

Hello @kaboomdev
Have you found a solution since?

It seems like you're correctly using the ?refresh=true query parameter to refresh a user's session. This parameter should indeed allow a logged-in user to re-authenticate without logging them out, unless another user signs in.

The error message you're receiving seems to suggest that a valid session was detected and thus login is not possible, which is a bit contradictory given that you're using the ?refresh=true parameter. This could potentially be a bug or a misconfiguration.

Without more specific information about your implementation and the exact circumstances under which this error occurs, it's hard to provide a definitive answer.
As a workaround, logging the user out before requesting the login flow is a valid approach, but it might not be the most user-friendly solution, especially if you need to refresh the session frequently.

I would recommend checking your implementation against the Ory documentation, particularly the sections on Refreshing a Session and Advanced Integration.