# consent_required

The request forbade interaction and the user has not consented to it (OpenID Connect Core 1.0 §3.1.2.6).

## Meaning

Sent by `/authorize`, redirected to the client, when the request carries `prompt=none`,
the user is signed in, and no stored approval covers the client, scopes and resource it
asks for. Clients registered by an administrator count as approved; dynamically
registered clients and public clients with a non-`https` redirect URI need the user's
approval.

## Impact

Normal protocol flow for a silent request: nobody is stuck, but the application has to
show the consent screen once with an interactive request. A public client with a
loopback redirect is asked every time, so its silent requests always end this way.

## Diagnosis

1. The audit record under `oauth.authorization.requested` has reason `consent_required`
   and cause `consent_not_granted`.
2. Compare the requested scopes and `resource` with what the user approved earlier
   (`oauth.consent.decided` records). See [Consent](https://www.nauthera.io/docs/v1/sessions#consent).

## Mitigation

- As a client developer: on `consent_required`, send the user through `/authorize`
  without `prompt=none`. Do not ask for more scopes in silent requests than the user
  approved.
- As an operator: register first-party applications through the operator or the
  AdminService, which counts as administrative consent.
- As a user: approve the request when the application shows the consent screen.

## Escalation

If a request covered by a stored approval is refused, open an issue with the request id,
the server version and the scopes requested.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.