Validate an existing session token and return the user object
curl --request POST \
--url http://localhost:2000/auth/validate-session \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"user": {
"_id": "<string>",
"emails": "user@example.com",
"role": "user"
}
}
'import requests
url = "http://localhost:2000/auth/validate-session"
payload = { "user": {
"_id": "<string>",
"emails": "user@example.com",
"role": "user"
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({user: {_id: '<string>', emails: 'user@example.com', role: 'user'}})
};
fetch('http://localhost:2000/auth/validate-session', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_PORT => "2000",
CURLOPT_URL => "http://localhost:2000/auth/validate-session",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'user' => [
'_id' => '<string>',
'emails' => 'user@example.com',
'role' => 'user'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "http://localhost:2000/auth/validate-session"
payload := strings.NewReader("{\n \"user\": {\n \"_id\": \"<string>\",\n \"emails\": \"user@example.com\",\n \"role\": \"user\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("http://localhost:2000/auth/validate-session")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"user\": {\n \"_id\": \"<string>\",\n \"emails\": \"user@example.com\",\n \"role\": \"user\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("http://localhost:2000/auth/validate-session")
http = Net::HTTP.new(url.host, url.port)
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"user\": {\n \"_id\": \"<string>\",\n \"emails\": \"user@example.com\",\n \"role\": \"user\"\n }\n}"
response = http.request(request)
puts response.read_body{
"data": {
"user": {
"_id": "<string>",
"emails": "user@example.com",
"role": "user"
}
}
}OAuth & Sessions
Validate Session
Protected route that returns the user object from the request body when the session is valid. Requires authentication and appropriate role middleware.
POST
/
auth
/
validate-session
Validate an existing session token and return the user object
curl --request POST \
--url http://localhost:2000/auth/validate-session \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"user": {
"_id": "<string>",
"emails": "user@example.com",
"role": "user"
}
}
'import requests
url = "http://localhost:2000/auth/validate-session"
payload = { "user": {
"_id": "<string>",
"emails": "user@example.com",
"role": "user"
} }
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({user: {_id: '<string>', emails: 'user@example.com', role: 'user'}})
};
fetch('http://localhost:2000/auth/validate-session', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_PORT => "2000",
CURLOPT_URL => "http://localhost:2000/auth/validate-session",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'user' => [
'_id' => '<string>',
'emails' => 'user@example.com',
'role' => 'user'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "http://localhost:2000/auth/validate-session"
payload := strings.NewReader("{\n \"user\": {\n \"_id\": \"<string>\",\n \"emails\": \"user@example.com\",\n \"role\": \"user\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("http://localhost:2000/auth/validate-session")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"user\": {\n \"_id\": \"<string>\",\n \"emails\": \"user@example.com\",\n \"role\": \"user\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("http://localhost:2000/auth/validate-session")
http = Net::HTTP.new(url.host, url.port)
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"user\": {\n \"_id\": \"<string>\",\n \"emails\": \"user@example.com\",\n \"role\": \"user\"\n }\n}"
response = http.request(request)
puts response.read_body{
"data": {
"user": {
"_id": "<string>",
"emails": "user@example.com",
"role": "user"
}
}
}Validate an existing session token and return the user object. Protected route that returns the user object from the request body when the session is valid. Requires authentication and appropriate role middleware.
Request
Headers
| Name | Type | Required | Description |
|---|---|---|---|
| Authorization | string | Yes | Bearer token |
| Content-Type | string | Yes | application/json |
Request Body
{
"user": {
"_id": "64b7f1a2e4b0a5d3f9c12345",
"emails": "user@example.com",
"role": "user"
}
}
Request Body Schema
| Field | Type | Required | Description |
|---|---|---|---|
| user | object | Yes | User object to validate |
Response
200 OK - Session valid
Returns the user object.{
"data": {
"user": {
"_id": "64b7f1a2e4b0a5d3f9c12345",
"emails": "user@example.com",
"role": "user"
}
}
}
401 Unauthorized
{
"error": {
"code": "UNAUTHORIZED",
"message": "Invalid or expired session token"
}
}
500 Internal Server Error
{
"error": {
"code": "SERVER_ERROR",
"message": "Internal server error"
}
}
Example
curl -X POST 'http://localhost:2000/auth/validate-session' \
-H 'Authorization: Bearer your-jwt-token' \
-H 'Content-Type: application/json' \
-d '{
"user": {
"_id": "64b7f1a2e4b0a5d3f9c12345",
"emails": "user@example.com",
"role": "user"
}
}'
Notes
- This endpoint requires a valid JWT token in the Authorization header
- The request body should contain the user object you want to validate
- This is useful for checking if a session is still active and valid
- The endpoint validates both the token and the user object in the request body
- Use this to implement session refresh logic in your application
Was this page helpful?