Own Session Management
Learn how to use your own session management while using Corbado’s passkey authentication solution.
The following documentation provides a detailed explanation how Corbado can be used with your own session management. If you build a new application without existing users, we strongly recommend to use Corbado’s session management, as this will save you a lot of implementation time and is a proven solution.
To use your own session management, you have to switch the toggle in the Corbado developer panel Settings > Sessions.
Overview
In the following, we’ll outline the step-by-step implementation of your own session management.
User logs in to your application
The user logs into your application using our UI Components.
Corbado backend creates JWT token
Upon successful login, the Corbado Frontend API responds with a short-term session JWT.
Request a session from your application
After receiving the Corbado short-term session, the user sends a request to your backend including the Corbado short-term session either as a cookie or in an authorization header.
Validate the Corbado short-term session in your backend
Your backend must verify the Corbado short-term session to be authentic. This can be done either by using a dedicated Corbado backend SDK or manually using our JWKS.
Create your own session
After confirming that the Corbado short-term session is authentic, so you can create your own session in the backend. Then, send your session to the user.
Store and use your own session
After the user receives your session, he can store it in any way you prefer (e.g. cookie or localstorage). Moving forward, it’s up to you how to handle your own session and what properties it should have.
Was this page helpful?