Issue registering a user with ory kratos

[philiplourandos]

I'm struggling getting my flutter application to register a user with Kratos. I have a shell script using the API where I am able to get a successful registration:

#!/bin/sh

init_response=$(http http://127.0.0.1:4433/self-service/registration/api)

flow_uri=$(echo $init_response | jq -r '.ui.action')

echo $flow_uri

http POST $flow_uri "method"="password" "traits.email"="[email protected]" "traits.name.first"="Rodger" "traits.name.last"="Wilco" "password"="kense#$%@@ntme5765" "traits.mobile"="1234567890"

I receive the following on the registration:

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Content-Length: 1922
Content-Type: application/json; charset=utf-8
Date: Fri, 29 Oct 2021 06:23:57 GMT
Vary: Origin
Vary: Cookie

{
    "identity": {
        "created_at": "2021-10-29T06:23:57.388886Z",
        "id": "19699c9b-14b7-4263-a15f-45803d000eea",
        "recovery_addresses": [
            {
                "created_at": "2021-10-29T06:23:57.410531Z",
                "id": "f4b6dbc7-0e98-4e10-bc90-d4c35fa982dd",
                "updated_at": "2021-10-29T06:23:57.410531Z",
                "value": "[email protected]",
                "via": "email"
            }
        ],
        "schema_id": "default",
        "schema_url": "http://127.0.0.1:4433/schemas/default",
        "state": "active",
        "state_changed_at": "2021-10-29T06:23:57.388568437Z",
        "traits": {
            "email": "[email protected]",
            "mobile": "1234567890",
            "name": {
                "first": "Rodger",
                "last": "Wilco"
            }
        },
        "updated_at": "2021-10-29T06:23:57.388886Z",
        "verifiable_addresses": [
            {
                "created_at": "2021-10-29T06:23:57.395915Z",
                "id": "fb13d7a7-aba7-41bd-aba2-75a9459e2d38",
                "status": "sent",
                "updated_at": "2021-10-29T06:23:57.395915Z",
                "value": "[email protected]",
                "verified": false,
                "verified_at": null,
                "via": "email"
            }
        ]
    },
    "session": {
        "active": true,
        "authenticated_at": "2021-10-29T06:23:57.467702368Z",
        "expires_at": "2021-10-30T06:23:57.428123866Z",
        "id": "45ec9e67-8022-4586-89eb-cb9d30c60888",
        "identity": {
            "created_at": "2021-10-29T06:23:57.388886Z",
            "id": "19699c9b-14b7-4263-a15f-45803d000eea",
            "recovery_addresses": [
                {
                    "created_at": "2021-10-29T06:23:57.410531Z",
                    "id": "f4b6dbc7-0e98-4e10-bc90-d4c35fa982dd",
                    "updated_at": "2021-10-29T06:23:57.410531Z",
                    "value": "[email protected]",
                    "via": "email"
                }
            ],
            "schema_id": "default",
            "schema_url": "http://127.0.0.1:4433/schemas/default",
            "state": "active",
            "state_changed_at": "2021-10-29T06:23:57.388568437Z",
            "traits": {
                "email": "[email protected]",
                "mobile": "1234567890",
                "name": {
                    "first": "Rodger",
                    "last": "Wilco"
                }
            },
            "updated_at": "2021-10-29T06:23:57.388886Z",
            "verifiable_addresses": [
                {
                    "created_at": "2021-10-29T06:23:57.395915Z",
                    "id": "fb13d7a7-aba7-41bd-aba2-75a9459e2d38",
                    "status": "sent",
                    "updated_at": "2021-10-29T06:23:57.395915Z",
                    "value": "[email protected]",
                    "verified": false,
                    "verified_at": null,
                    "via": "email"
                }
            ]
        },
        "issued_at": "2021-10-29T06:23:57.428141826Z"
    },
    "session_token": "89aLaF0Gue7jc5TmshY5rQv52wDwJbhU"
}

I am able to make the first call to self-service/registration/api fine and receive the flow id. However on the self-service/registration/flows?id=XXX I see the following in the in the kratos logs:

kratos_1               | time=2021-10-29T07:13:01Z level=error msg=An error occurred while handling a request audience=application error=map[debug: details:map[docs:https://www.ory.sh/kratos/docs/debug/csrf hint:The anti-CSRF cookie was found but the CSRF token was not included in the HTTP request body (csrf_token) nor in the HTTP Header (X-CSRF-Token). reject_reason:The HTTP Cookie Header was set and a CSRF token was sent but they do not match. We recommend deleting all cookies for this domain and retrying the flow.] message:the request was rejected to protect you from Cross-Site-Request-Forgery reason:The request was rejected to protect you from Cross-Site-Request-Forgery (CSRF) which could cause account takeover, leaking personal information, and other serious security issues. status:Forbidden status_code:403] http_request=map[headers:map[accept:application/json accept-encoding:gzip content-length:133 content-type:application/json; charset=utf-8 forwarded:proto=http;host="backend.trusteeman.co.za:9080";for="10.0.2.2:39498" user-agent:Dart/2.14 (dart:io) x-forwarded-for:10.0.2.2 x-forwarded-host:backend.trusteeman.co.za:9080 x-forwarded-port:9080 x-forwarded-proto:http] host:kratos:4433 method:POST path:/self-service/registration/flows/id=29806d2f-a793-4815-bb2e-dd89255ac524 query:<nil> remote:172.18.0.8:48238 scheme:http] http_response=map[status_code:403] service_name=Ory Kratos service_version=v0.7.6-alpha.1
kratos_1               | time=2021-10-29T07:13:01Z level=info msg=started handling request http_request=map[headers:map[accept:application/json accept-encoding:gzip content-length:133 content-type:application/json; charset=utf-8 forwarded:proto=http;host="backend.trusteeman.co.za:9080";for="10.0.2.2:39498" user-agent:Dart/2.14 (dart:io) x-forwarded-for:10.0.2.2 x-forwarded-host:backend.trusteeman.co.za:9080 x-forwarded-port:9080 x-forwarded-proto:http] host:kratos:4433 method:POST path:/self-service/registration/flows/id=29806d2f-a793-4815-bb2e-dd89255ac524 query:<nil> remote:172.18.0.8:48238 scheme:http]
kratos_1               | time=2021-10-29T07:13:01Z level=info msg=completed handling request http_request=map[headers:map[accept:application/json accept-encoding:gzip content-length:133 content-type:application/json; charset=utf-8 forwarded:proto=http;host="backend.trusteeman.co.za:9080";for="10.0.2.2:39498" user-agent:Dart/2.14 (dart:io) x-forwarded-for:10.0.2.2 x-forwarded-host:backend.trusteeman.co.za:9080 x-forwarded-port:9080 x-forwarded-proto:http] host:kratos:4433 method:POST path:/self-service/registration/flows/id=29806d2f-a793-4815-bb2e-dd89255ac524 query:<nil> remote:172.18.0.8:48238 scheme:http] http_response=map[headers:map[content-type:application/json set-cookie:csrf_token_806060ca5bf70dff3caa0e5c860002aade9d470a5a4dce73bcfa7ba10778f481=0FE+eI5iwMUr8DfsR9yeimE7wcp9uk4MggzN8NS9cFk=; Path=/; Max-Age=31536000; HttpOnly; SameSite=Lax vary:Origin] size:706 status:403 text_status:Forbidden took:184.317µs]

Now in the init there a entry for csrf_token but the value is empty.

I'm not sure what I am missing. Any help greatly appreciated

Edit 1: Running kratos 0.7.6. There is spring cloud api gateway that is forwarding the request to kratos from the flutter app.

Edit 2: So the script was connecting directly to kratos. I've changed it to use the API gateway and seeing the same issue now.

[aeneasr]

I believe there was a bug in kratos 0.7.6 where this could happen, maybe try the new kratos 0.8?

[philiplourandos]

My screw up. I was using the wrong URL. Was using:

/self-service/registration/flows?id=XXX

This is the correct one for API:

/self-service/registration?flow=XXX