Behaviour of return_to query parameter with MFA/2FA

[harnash]

Hi.

We have stumbled on an interesting behaviour when using MFA in Kratos with return_to parameter.
When login flow is initialized via /self-service/login/browser and return_to parameter is specified user will be redirected to that URL even when login session is not fully authorized (only first login factor is completed).

Steps to reproduce:

1. Login with user that has MFA enabled but do not enter 2FA code and just return to /self-service/login/browser with return_to URL set to some arbitrary address
2. Kratos will verify that session is valid but will not check if user completed 2FA and will redirect to URL specified in return_to parameter causing an infinite loop

Workaround would be to set refresh query parameter to 1 but this will force user to re-authenticate.

Is this flow intended?

[aeneasr]

That sounds like a bug - if MFA is required it should redirect to the MFA page!

[brahma-dev]

Stumbled upon the same loop. Is there a fix/better workaround for this now ?

[Benehiko]

I confirmed this as well now, and created an issue based on this discussion #3356

@brahma-dev you will need to add the refresh=true or aal=aal2 parameter on the login request to the UI or to Kratos.
@harnash the aal=aal2 query parameter also forces the user to the MFA screen.

e.g. https://my-custom-domain.com/ui/login?aal=aal2&return_to=https://example.com or https://my-custom-domain.com/self-service/login/browser?refresh=true&return_to=https://example.com