What is the best practice to validate sessionToken without having to recreate a new sessionId each time?

victor.suciu1.4398562980308286E12 (Okta, Inc.)

Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:28 AM

Hi Ryan!

Indeed, to create an Okta session you will need to use the call specified here http://developer.okta.com/docs/api/resources/sessions.html#create-session-with-session-token. Once you have the session Id in response to this call. Send it in the header of your API call. In backend you can make the call to GET /sessions/<sessionID> using the session id you sent in header http://developer.okta.com/docs/api/resources/sessions.html#get-session, to make sure it is still valid. This will also give you user information. Please not if you are making the call from browser you can use http://developer.okta.com/docs/api/resources/sessions.html#get-current-session to get current session as well.

If you use a Sign widget then a second approach will be to use OpenID/OAuth from login widget. You would need to create Open ID app in Okta if you have not already (we would need to enable Open ID for your org before). Link for OIDC/OAuth http://developer.okta.com/docs/api/resources/oidc.html and http://developer.okta.com/docs/api/resources/oauth2.html. See this section on how to get id token/access token http://developer.okta.com/code/javascript/okta_sign-in_widget_ref.html#oidc-options. Access token will be best suited for your need. Once yo haev the access token you can send it via Authorization header as "Bearer <AccessToken>". Backend will retrieve it and give access based on the valid access token or make the call to GET /userinfo endpoint http://developer.okta.com/docs/api/resources/oidc.html#get-user-information to get the user info for whom access token was generated.

If you have further questions, feel free to open a case with us.

Expand Post

victor.suciu1.4398562980308286E12 (Okta, Inc.)
Edited by varun.kavoori1.5210444522562532E12 September 5, 2018 at 1:28 AM
Hi Ryan!

Indeed, to create an Okta session you will need to use the call specified here http://developer.okta.com/docs/api/resources/sessions.html#create-session-with-session-token. Once you have the session Id in response to this call. Send it in the header of your API call. In backend you can make the call to GET /sessions/<sessionID> using the session id you sent in header http://developer.okta.com/docs/api/resources/sessions.html#get-session, to make sure it is still valid. This will also give you user information. Please not if you are making the call from browser you can use http://developer.okta.com/docs/api/resources/sessions.html#get-current-session to get current session as well.

If you use a Sign widget then a second approach will be to use OpenID/OAuth from login widget. You would need to create Open ID app in Okta if you have not already (we would need to enable Open ID for your org before). Link for OIDC/OAuth http://developer.okta.com/docs/api/resources/oidc.html and http://developer.okta.com/docs/api/resources/oauth2.html. See this section on how to get id token/access token http://developer.okta.com/code/javascript/okta_sign-in_widget_ref.html#oidc-options. Access token will be best suited for your need. Once yo haev the access token you can send it via Authorization header as "Bearer <AccessToken>". Backend will retrieve it and give access based on the valid access token or make the call to GET /userinfo endpoint http://developer.okta.com/docs/api/resources/oidc.html#get-user-information to get the user info for whom access token was generated.

If you have further questions, feel free to open a case with us.
Expand Post

Your Privacy

Your Privacy

Strictly Necessary Cookies

Strictly Necessary Cookies

Functional Cookies

Functional Cookies

Performance Cookies

Performance Cookies

Share or Sell of Personal Data

Share or Sell of Personal Data

Advertising Cookies

Your Privacy

Your Privacy

Strictly Necessary Cookies

Strictly Necessary Cookies

Functional Cookies

Functional Cookies

Performance Cookies

Performance Cookies

Share or Sell of Personal Data

Share or Sell of Personal Data

Advertising Cookies