helpful-ghost-20314
04/04/2025, 8:25 AMbrief-egg-61061
04/04/2025, 8:25 AMbrief-egg-61061
04/04/2025, 8:26 AMSet-Cookie
HTTP header. This happens after a successful login or registration (if the session
after hook is enabled). For example, after a successful login, Ory sets cookies like this: Set-Cookie: csrf_token=b8OebRPTPr5ow23mA5gIZmFNLeuMbv8pZz1jT1Ex7ys=; Path=/; Domain=127.0.0.1; Max-Age=31536000; HttpOnly Set-Cookie: ory_kratos_session=MTU5OTE2ODc2N3xEdi1CQkFFQ180SUFBUkFCRUFBQVJfLUNBQUVHYzNSeWFXNW5EQThBRFhObGMzTnBiMjVmZEc5clpXNEdjM1J5YVc1bkRDSUFJR055VlROMGRteHhSakJrUzBkbmRUUjBlVFY1V0RCRWFVTnJXVmR6V25oaHx2DICsB6IMbaHSQwnYITUZqr7Qx7CxUlnaneJWH495wQ==; Path=/; Expires=Fri, 04 Sep 2020 21:32:47 GMT; Max-Age=86400; HttpOnly; SameSite=Lax
If you need to validate or check a session in your application, you would use the /sessions/whoami
endpoint or the SDK's toSession()
method, which accepts the session cookie and returns the session information. For backend applications, you would typically forward the cookies received from the frontend when calling Ory's API to validate the session, as mentioned in the [Migrate to Ory tutorial](https://www.ory.sh/docs/migrate-to-ory#integrate-backend). If you're looking to create administrative capabilities, Ory's approach is to use regular user accounts with appropriate permissions rather than having a special "admin" session type.