# login_required

The request forbade interaction and the user has no session that satisfies it (OpenID Connect Core 1.0 §3.1.2.6).

## Meaning

Sent by `/authorize`, redirected to the client, when the request carries `prompt=none`
and the browser has no session for this organization, or the session is older than the
request's `max_age`. A session from another organization never counts. Without
`prompt=none` the user would be sent to sign in instead.

## Impact

Normal protocol flow: a silent sign-in or silent token renewal found nobody signed in.
Nobody is stuck; the application has to start an interactive sign-in. Browsers that do
not send the session cookie in a third-party context make every silent request in a
hidden iframe end this way.

## Diagnosis

1. The audit record under `oauth.authorization.requested` has reason `login_required`
   and a cause naming the session rule that failed, such as `session_foreign_org` or
   `max_age_exceeded`.
2. If the user believes they are signed in, check the session on the user's Sessions tab
   on the dashboard, and whether the browser sent the session cookie.

## Mitigation

- As a client developer: on `login_required`, redirect the user to `/authorize` without
  `prompt=none`. Prefer refresh tokens to silent iframe renewal.
- As an operator: nothing to change on the server.
- As a user: sign in when the application asks.

## Escalation

If a user with a fresh session in the same organization gets it on every request, open an
issue with the request id, the server version and the recorded cause. Never attach
cookies or tokens.

---

[OAuth error runbooks](https://www.nauthera.io/docs/v1/runbooks/oauth) · Generated from [`internal/runbook/oauth.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/oauth.yaml) in nauthera-server.