# Get Current Session API Server Side

**URL:** <https://devforum.okta.com/t/get-current-session-api-server-side/6787>\
**Category:** Questions\
**Created:** [November 4, 2019, 5:07pm UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787 "2019-11-04T17:07:27Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![mjastrzebski](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@mjastrzebski](https://devforum.okta.com/u/mjastrzebski)\
**Post date:** [November 4, 2019, 5:07pm UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787/1 "2019-11-04T17:07:28Z")

</div>

Is it possible to call the Get Current Session api (/api/v1/sessions/me) from the server side? Everytime I call it (c #) I get ‘404’ even if I have an Okta session.

If I call it using Javascript, I get a response when I have an Okta session.

Is this api only meant to be called in client? The client call doesn’t fit into our workflow.

---

<div class="post-metadata">

**Author:** ![gsvivek](https://avatars.discourse-cdn.com/v4/letter/g/b4bc9f/32.png) [@gsvivek](https://devforum.okta.com/u/gsvivek)\
**Post date:** [November 6, 2019, 6:25am UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787/2 "2019-11-06T06:25:02Z")

</div>

Since your application domain would not match your Okta domain, browser would not send the Okta cookie to your server and unless you have the Okta session cookie value on the server side, this call cannot be made from the server - it will have to be made from the client side. On the client side, browser will automatically pass the Okta cookie which will be used by Okta to identify the session is valid or not and provide details about the user. What is the user workflow? You may have to look at alternative way of getting session details or find a way to pass the info from client to server.

---

<div class="post-metadata">

**Author:** ![mjastrzebski](https://avatars.discourse-cdn.com/v4/letter/m/9fc29f/32.png) [@mjastrzebski](https://devforum.okta.com/u/mjastrzebski)\
**Post date:** [November 6, 2019, 2:51pm UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787/3 "2019-11-06T14:51:16Z")

</div>

Thanks for the response. Just wanted confirmation that the server side call was not going to work. I have updated to used client and is working now.

---

<div class="post-metadata">

**Author:** ![kunal.parekh](https://avatars.discourse-cdn.com/v4/letter/k/5fc32e/32.png) [@kunal.parekh](https://devforum.okta.com/u/kunal.parekh)\
**Post date:** [January 16, 2020, 3:26pm UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787/4 "2020-01-16T15:26:28Z")

</div>

What exactly you did to make this work at client side ? please let me know.

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [January 29, 2020, 6:27am UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787/5 "2020-01-29T06:27:23Z")

</div>

Hi @kunal.parekh

Here’s an example to retrieve the current session via client side

```auto
var baseUrl = 'https://yourOktaCompany.okta.com';
var xhr = new XMLHttpRequest();
if ("withCredentials" in xhr) {
    xhr.onerror = function() {
      alert('Invalid URL or Cross-Origin Request Blocked. You must explicitly add this site (' + window.location.origin + ') to the list of allowed websites in the administrator UI');
    }
    xhr.onload = function() {
        alert(this.responseText);
    };
    xhr.open('GET', baseUrl + '/api/v1/sessions/me', true);
    xhr.withCredentials = true;
    xhr.send();
} else {
    alert("CORS is not supported for this browser!")
}

```

---

<div class="post-metadata">

**Author:** ![shutchinson](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@shutchinson](https://devforum.okta.com/u/shutchinson)\
**Post date:** [January 31, 2020, 9:51pm UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787/6 "2020-01-31T21:51:55Z")

</div>

Hi @dragos,

Your code snippet works great from Chrome, but always returns error “E0000007”, no session found, when run in IE11. Is there something blocking IE11 from reading the session cookie? How can I get an existing session from IE11?

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [February 3, 2020, 2:28am UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787/7 "2020-02-03T02:28:11Z")

</div>

Hi @shutchinson

I’ve just checked the script on my end in Internet Explorer 11 and I did not encounter any issues.

![image](https://global.discourse-cdn.com/oktadev/original/2X/c/c642cea5a7727698635adc575fef8e436ee3a9b6.png)

Can you please check if you have an active session in Okta in IE11 when running the script and if the browser policies allow CORS?

---

<div class="post-metadata">

**Author:** ![shutchinson](https://avatars.discourse-cdn.com/v4/letter/s/34f0e0/32.png) [@shutchinson](https://devforum.okta.com/u/shutchinson)\
**Post date:** [February 3, 2020, 6:03pm UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787/8 "2020-02-03T18:03:54Z")

</div>

The browser policies allow CORS, and I can authenticate and redirect just fine. Every test I have done in IE11 tells me that I don’t have an active Okta session though. This is perplexing because the same code works perfectly well in Chrome.

Is there some special way to set the Session in IE11? I am currently using the OktaSignIn widget for JS.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 4, 2020, 6:35pm UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787/9 "2020-02-04T18:35:58Z")

</div>

Since you mentioned that you’re using IE 11, can you also check the settings there to ensure the following:

1. IE is set to allow third party cookies as Okta sets a session cookie, ‘sid,’ upon successful authentication
2. Your Okta domain, such as https://{{org}}.okta.com, and, if you are using one, your Custom Domain are added as Trusted Sites in IE

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 24, 2024, 6:45pm UTC](https://devforum.okta.com/t/get-current-session-api-server-side/6787/10 "2024-01-24T18:45:37Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.