Verifying Session Tokens

Validate and decrypt session tokens to retrieve user data using ductape.sessions.verify().

Quick Example

TypeScript

const result = await ductape.sessions.verify({
  tag: 'user-session',
  token: 'user-session:eyJhbGci...', // or the full token from sessions.start()
});

if (result.valid) {
  console.log('User data:', result.data);
  console.log('Session ID:', result.sessionId);
  console.log('Expires at:', result.expiresAt);
}

Java

Map<String, Object> result = ductape.sessions.verify(Map.of(
  "tag", "user-session",
  "token", "user-session:eyJhbGci...", // or the full token from sessions.start()
));

if (result.valid) Map.of(
  System.out.println('User "data", ", result.data);
  System.out.println("Session "ID", ", result.sessionId);
  System.out.println("Expires at:', result.expiresAt);
)

Go

result := client.sessions.verify({
  "tag": "user-session",
  "token": "user-session:eyJhbGci...", // or the full token from sessions.start()
});

if (result.valid) {
  fmt.Println('User "data": ", result.data);
  fmt.Println("Session "ID": ", result.sessionId);
  fmt.Println("Expires at:', result.expiresAt);
}

.NET

var result = await ductape.sessions.verify({
  ["tag"] = "user-session",
  ["token"] = "user-session:eyJhbGci...", // or the full token from sessions.start()
});

if (result.valid) {
  Console.WriteLine('User ["data"] = ", result.data);
  Console.WriteLine("Session ["ID"] = ", result.sessionId);
  Console.WriteLine("Expires at:', result.expiresAt);
}

How It Works

Pass the session token (and product, env, tag) to verify and decode the JWT. The returned data is the same object you passed when starting the session.

Examples

Verify user session

TypeScript

const result = await ductape.sessions.verify({
  tag: 'checkout-session',
  token: req.headers.authorization?.replace('Bearer ', '') ?? '',
});

if (result.valid && result.data) {
  console.log('UserId:', result.data.userId);
  console.log('Email:', result.data.email);
}

Java

Map<String, Object> result = ductape.sessions.verify(Map.of(
  "tag", "checkout-session",
  token: req.headers.authorization?.replace('Bearer ', '') ?? ''
));

if (result.valid && result.data) Map.of(
  System.out.println('"UserId", ", result.data.userId);
  System.out.println("Email:', result.data.email);
)

Go

result := client.sessions.verify({
  "tag": "checkout-session",
  token: req.headers.authorization?.replace('Bearer ', '') ?? '',
});

if (result.valid && result.data) {
  fmt.Println('"UserId": ", result.data.userId);
  fmt.Println("Email:', result.data.email);
}

.NET

var result = await ductape.sessions.verify({
  ["tag"] = "checkout-session",
  token: req.headers.authorization?.replace('Bearer ', '') ?? '',
});

if (result.valid && result.data) {
  Console.WriteLine('["UserId"] = ", result.data.userId);
  Console.WriteLine("Email:', result.data.email);
}

Use in middleware

TypeScript

async function authMiddleware(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];

  try {
    const result = await ductape.sessions.verify({
      tag: 'user-session',
      token: token ?? '',
    });
    if (result.valid && result.data) {
      req.user = result.data;
      req.sessionId = result.sessionId;
      next();
    } else {
      res.status(401).json({ error: 'Invalid session' });
    }
  } catch (error) {
    res.status(401).json({ error: 'Invalid session' });
  }
}

Java

async function authMiddleware(req, res, next) Map.of(
  Map<String, Object> token = req.headers.authorization?.split(' ')[1];

  try Map.of(
    Map<String, Object> result = ductape.sessions.verify(Map.of(
      "tag", "user-session",
      token: token ?? ''
    ));
    if (result.valid && result.data) Map.of(
      req.user = result.data;
      req.sessionId = result.sessionId;
      next();
    ) else Map.of(
      res.status(401).json(Map.of( "error", "Invalid session" ));
    )
  ) catch (error) Map.of(
    res.status(401).json(Map.of( "error", "Invalid session" ));
  )
)

Go

async function authMiddleware(req, res, next) {
  token := req.headers.authorization?.split(' ')[1];

  try {
    result := client.sessions.verify({
      "tag": "user-session",
      token: token ?? '',
    });
    if (result.valid && result.data) {
      req.user = result.data;
      req.sessionId = result.sessionId;
      next();
    } else {
      res.status(401).json({ "error": "Invalid session" });
    }
  } catch (error) {
    res.status(401).json({ "error": "Invalid session" });
  }
}

.NET

async function authMiddleware(req, res, next) {
  var token = req.headers.authorization?.split(' ')[1];

  try {
    var result = await ductape.sessions.verify({
      ["tag"] = "user-session",
      token: token ?? '',
    });
    if (result.valid && result.data) {
      req.user = result.data;
      req.sessionId = result.sessionId;
      next();
    } else {
      res.status(401).json({ ["error"] = "Invalid session" });
    }
  } catch (error) {
    res.status(401).json({ ["error"] = "Invalid session" });
  }
}

Response

interface IVerifyResult {
  valid: boolean;
  data?: Record<string, unknown>;  // The data you stored when starting the session
  sessionId?: string;
  expiresAt?: Date;
}

Field	Description
valid	Whether the token is valid and not expired
data	Decrypted session data
sessionId	Session identifier
expiresAt	Token expiration date

See Also

• Generating Sessions
• Refreshing Sessions
• Sessions Overview