Sign in
v0alpha1

Check Who the Current HTTP Session Belongs To

Uses the HTTP Headers in the GET request to determine (e.g. by using checking the cookies) who is authenticated. Returns a session object in the body or 401 if the credentials are invalid or no credentials were sent. Additionally when the request it successful it adds the user ID to the 'X-Kratos-Authenticated-Identity-Id' header in the response.

If you call this endpoint from a server-side application, you must forward the HTTP Cookie Header to this endpoint:

pseudo-code example
router.get('/protected-endpoint', async function (req, res) {
const session = await client.toSession(undefined, req.header('cookie'))

console.log(session)
})

When calling this endpoint from a non-browser application (e.g. mobile app) you must include the session token:

pseudo-code example
...
const session = await client.toSession("the-session-token")

console.log(session)

This endpoint is useful for:

AJAX calls. Remember to send credentials and set up CORS correctly! Reverse proxies and API Gateways Server-side calls - use the X-Session-Token header!

This endpoint authenticates users by checking

if the Cookie HTTP header was set containing an Ory Kratos Session Cookie; if the Authorization: bearer <ory-session-token> HTTP header was set with a valid Ory Kratos Session Token; if the X-Session-Token HTTP header was set with a valid Ory Kratos Session Token.

If none of these headers are set or the cooke or token are invalid, the endpoint returns a HTTP 401 status code.

get/sessions/whoami

Headers

X-Session-Tokenstring

Set the Session Token when calling from non-browser clients. A session token has a format of MP2YWEMeM8MxjkGKpH4dqOQ4Q4DlSPaj.

Cookiestring

Set the Cookie Header. This is especially useful when calling this endpoint from a server-side application. In that scenario you must include the HTTP Cookie Header which originally was included in the request to your server. An example of a session in the HTTP Cookie Header is: ory_kratos_session=a19iOVAbdzdgl70Rq1QZmrKmcjDtdsviCTZx7m9a9yHIUS8Wa9T7hvqyGTsLHi6Qifn2WUfpAKx9DWp0SJGleIn9vh2YF4A16id93kXFTgIgmwIOvbVAScyrx7yVl6bPZnCx27ec4WQDtaTewC1CpgudeDV2jQQnSaCP6ny3xa8qLH-QUgYqdQuoA_LF1phxgRCUfIrCLQOkolX5nv3ze_f==.

It is ok if more than one cookie are included here as all other cookies will be ignored.

Response

session

activeboolean

Whether or not the session is active.

authenticated_atstring date-time

The Session Authentication Timestamp

When this session was authenticated at.

expires_atstring date-time

The Session Expiry

When this session expires at.

idstring uuid4 required
issued_atstring date-time

The Session Issuance Timestamp

When this session was authenticated at.

Example response

{
  "expires_at": "2000-01-23T04:56:07.000+00:00",
  "identity": {
    "recovery_addresses": [
      {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "id": "id",
        "value": "value",
        "via": "via"
      },
      {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "id": "id",
        "value": "value",
        "via": "via"
      }
    ],
    "traits": "",
    "updated_at": "2000-01-23T04:56:07.000+00:00",
    "credentials": {
      "key": {
        "updated_at": "2000-01-23T04:56:07.000+00:00",
        "identifiers": [
          "identifiers",
          "identifiers"
        ],
        "created_at": "2000-01-23T04:56:07.000+00:00",
        "type": "type",
        "config": "{}"
      }
    },
    "verifiable_addresses": [
      {
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified_at": "2000-01-23T04:56:07.000+00:00",
        "verified": true,
        "created_at": "2014-01-01T23:28:56.782Z",
        "id": "id",
        "value": "value",
        "status": "status",
        "via": "via"
      },
      {
        "updated_at": "2014-01-01T23:28:56.782Z",
        "verified_at": "2000-01-23T04:56:07.000+00:00",
        "verified": true,
        "created_at": "2014-01-01T23:28:56.782Z",
        "id": "id",
        "value": "value",
        "status": "status",
        "via": "via"
      }
    ],
    "schema_id": "schema_id",
    "state_changed_at": "2000-01-23T04:56:07.000+00:00",
    "created_at": "2000-01-23T04:56:07.000+00:00",
    "schema_url": "schema_url",
    "id": "id"
  },
  "authenticated_at": "2000-01-23T04:56:07.000+00:00",
  "active": true,
  "id": "id",
  "issued_at": "2000-01-23T04:56:07.000+00:00"
}

Changes