How to keep /userinfo id_token session on relogin

ORY Hydra
#1

I implemented the Oauth2 flow according to the docs https://www.ory.sh/docs/hydra/oauth2#implementing-a-login-consent-provider in Node.js.

When i accept the consent part i save some additional user information in

session: {
  id_token: {...}
}

After a successful login i can get those additional information when i call the /userinfo endpoint. So far so good. But when i start the whole login / consent flow again the endpoints tell me to skip login and to skip consent. I accept both the login and the consent requests without any additional session details. But when i call the /userinfo endpoint now i don’t get the additional information anymore.

Is this the way OAuth2 is supposed to work or am i doing something wrong?

#2

Yes, this is how it is supposed to work - you need to set the session data on every request because a request represents a new session!