phrased another way, is my backend supposed to query /sessions/whoami?

I think the only ways is to query whoami. The cookie is httponly, so you won't be able to access it.

Janek is correct here. You need to call whoami.

I think login and registration API returns id info, you can save it in localstorage and check it before doing whoami. This could speed up discovering if the user is logged in.

Yea you can use some caching or local storage strategies to reduce the amount of calls you make to Kratos! / We do not have documentation for this however (yet!)

@User How is the this JSON returned together with the 303 redirection? https://www.ory.sh/docs/kratos/self-service/flows/user-registration#with-auto-login-on-registration-1

Right, this is described here: https://www.ory.sh/docs/kratos/concepts/browser-redirect-flow-completion#json Do you think we should add a link from the self-service docs to this to make it easier to find?