Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

login_required

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

The request forbade interaction and the user has no session that satisfies it (OpenID Connect Core 1.0 §3.1.2.6).

Meaning

Sent by /authorize, redirected to the client, when the request carries prompt=none and the browser has no session for this organization, or the session is older than the request's max_age. A session from another organization never counts. Without prompt=none the user would be sent to sign in instead.

Impact

Normal protocol flow: a silent sign-in or silent token renewal found nobody signed in. Nobody is stuck; the application has to start an interactive sign-in. Browsers that do not send the session cookie in a third-party context make every silent request in a hidden iframe end this way.

Diagnosis

  1. The audit record under oauth.authorization.requested has reason login_required and a cause naming the session rule that failed, such as session_foreign_org or max_age_exceeded.
  2. If the user believes they are signed in, check the session on the user's Sessions tab on the dashboard, and whether the browser sent the session cookie.

Mitigation

  • As a client developer: on login_required, redirect the user to /authorize without prompt=none. Prefer refresh tokens to silent iframe renewal.
  • As an operator: nothing to change on the server.
  • As a user: sign in when the application asks.

Escalation

If a user with a fresh session in the same organization gets it on every request, open an issue with the request id, the server version and the recorded cause. Never attach cookies or tokens.

OAuth error runbooks · Generated from internal/runbook/oauth.yaml in nauthera-server.