profile:back button method not working

[blitss]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

So apparently two stage sign up introduces a new UI node which is a "back button":

{
        "type": "input",
        "group": "profile",
        "attributes": {
          "name": "method",
          "type": "submit",
          "value": "profile:back",
          "disabled": false,
          "node_type": "input"
        },
        "messages": [],
        "meta": {
          "label": {
            "id": 1040008,
            "text": "Back",
            "type": "info"
          }
        }
      }

But the problem is profile:back method is not exposed in OpenAPI specs, not supported by API and hence not available in clients. Even calling it directly via API doesn't do anything, although I think it should be implemented (https://github.com/ory/kratos/blob/master/selfservice/strategy/profile/two_step_registration.go#L130):

 curl 'http://localhost:3000/api/.ory/self-service/registration?flow=6052dc7f-7fa0-4979-8df2-96b58c25f005'
...
 --data-raw '{"csrf_token":"....","method":"profile:back"}' | jq

Outputs the same form for credential selection. Tested with Typescript SDK, that's something you're unable to do:

await sdk.updateRegistrationFlow({
        flow: flow!.id,
        updateRegistrationFlowBody: {
          method: 'profile:back',
        },
      })

Reproducing the bug

Try using the back button in second stage of sign up

Relevant log output

No response

Relevant configuration

No response

Version

image: oryd/kratos:v1.2.0

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Docker

Additional Context

No response

[christoph-kluge]

I had the same issue. Please check/send all required traits as well with the profile:back.

There is an integration test for it here and the code does also support profile:back here. What I found out is that there is an early exit here which is handled when decoding (and validating) is not possible. Checking /registration/flows?id={flowId} showed me that the email trait was missing.

So before the fix my payload contained only this:

csrf_token: {token}
method: profile:back

After fixing my cusotm ui with all traits it started to work.

traits.email: [email protected]
traits.name.first: john
traits.name.last: doe
csrf_token: {token}
method: profile:back

[blitss]

I had the same issue. Please check/send all required traits as well with the profile:back.

Yeah nice find figured that too eventually.

tbh I'm going to migrate off Kratos because although the idea of auth ecosystem is good the Kratos itself strikes me as very unpolished product. Had too much moments where I just had to look at what's going on in the Kratos code internally (shining example is - try to mark users signing with google account as verified in kratos) since docs are more focused on their SaaS offering.

Maybe it's fine when you use their integrated UIs but when you try to build your own React/SPA UI it's a nightmare and there aren't good examples you can follow; also typescript library is broken and isn't completely typed.

Currently I'm trying to deal with issue where settings flow appears only in 1 out of 6-8 cases (otherwise - it's just empty response, literally nothing and 200 resp code) and that's just stupid

And maintainers obv don't even look at the issues.

I guess all that funding and 4 yrs of development didn't help to create a good auth offering