Is it OK to expose the login_challenge & consent_challenge to the browser

[joel-toby]

Hey 👋 , I was just looking through this Ory guide (really good btw).

I was wondering if the login_challenge & consent_challenge are intended to be kept server-side (private) or if it's OK to expose them to the browser? Would exposing the challenges defeat the purpose?

I'm just getting started with this stuff, so apologies if this is silly question.

Cheers.

[joel-toby]

Answering my own question: Hydra appends the challenges to the redirect urls, so it's available to the browser.