helpful-ghost-20314
04/04/2025, 8:25 AMchilly-king-10285
04/04/2025, 8:25 AMchilly-king-10285
04/04/2025, 8:26 AMSet-Cookie HTTP header. This happens after a successful login or registration (if the session after hook is enabled). For example, after a successful login, Ory sets cookies like this: Set-Cookie: csrf_token=b8OebRPTPr5ow23mA5gIZmFNLeuMbv8pZz1jT1Ex7ys=; Path=/; Domain=127.0.0.1; Max-Age=31536000; HttpOnly Set-Cookie: ory_kratos_session=MTU5OTE2ODc2N3xEdi1CQkFFQ180SUFBUkFCRUFBQVJfLUNBQUVHYzNSeWFXNW5EQThBRFhObGMzTnBiMjVmZEc5clpXNEdjM1J5YVc1bkRDSUFJR055VlROMGRteHhSakJrUzBkbmRUUjBlVFY1V0RCRWFVTnJXVmR6V25oaHx2DICsB6IMbaHSQwnYITUZqr7Qx7CxUlnaneJWH495wQ==; Path=/; Expires=Fri, 04 Sep 2020 21:32:47 GMT; Max-Age=86400; HttpOnly; SameSite=Lax If you need to validate or check a session in your application, you would use the /sessions/whoami endpoint or the SDK's toSession() method, which accepts the session cookie and returns the session information. For backend applications, you would typically forward the cookies received from the frontend when calling Ory's API to validate the session, as mentioned in the [Migrate to Ory tutorial](https://www.ory.sh/docs/migrate-to-ory#integrate-backend). If you're looking to create administrative capabilities, Ory's approach is to use regular user accounts with appropriate permissions rather than having a special "admin" session type.