Recovery flow breaks with emails containing uppercase characters

[nkeenan38]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• This issue affects my Ory Cloud project.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Describe the bug

When an identity is created with an email containing uppercase characters, most self-service flow correctly behave and ignore casing. It seems that uppercase letter break the recovery flow. No matter the casing of the input, the recovery flow always sends the invalid recovery email template. This happens even when the value in identity_recovery_addresses has the same casing as the trait in the email.

Reproducing the bug

1. Create a new user with an email containing uppercase characters through self-service registration.
2. Verify the email if necessary in the configuration.
3. Try the self service recovery flow with the email used.

The email in question should receive the invalid recovery email template.

Relevant log output

No response

Relevant configuration

No response

Version

v0.9.0

On which operating system are you observing this issue?

Linux

In which environment are you deploying?

Kubernetes

Additional Context

No response

[aeneasr]

Thank you for the report - I believe that this was fixed but it is possible that it wasn't. Are you 100% certain to be on the latest version of Ory Kratos? You can confirm this using kratos version. Thanks!

[kszafran]

I have just encountered a similar problem. It worked in 0.8.2. I suspect the problem is that the code has been changed in 0.9.0 to store recovery and verifiable email addresses in lowercase, but migrations haven't converted existing addresses. So users created with uppercase chars before upgrading to 0.9.0 can't go through the recovery flow. It can be fixed by updating addresses in the DB:

update identity_recovery_addresses set value=lower(value);
update identity_verifiable_addresses set value=lower(value);

Users created in 0.9.0 don't exhibit this problem.

[fokoenecke]

We just updated from 0.8.2 to 0.9.0-alpha.3 and encountered the same problem for new users. (not able to reproduce in 0.8.2).