How to manage user sessions in Bubble

Bubble manages user sessions automatically after a user logs in or signs up. Once authenticated, Bubble stores a secure session cookie in the browser, and from that point you use Current User to identify who is logged in. Your job is mainly to control when a session begins (login/signup), when it ends (log the user out), and what data the user can access using Privacy Rules.

What “session” means in Bubble

A session is simply Bubble remembering who the user is across pages. This happens through a browser cookie that Bubble handles for you. You don’t need to build any manual token system.

• A session starts when you run the workflow action Log the user in.
• A session ends when you run Log the user out.
• Bubble automatically refreshes the session while the user is active.

How to start a session

Create a login/signup workflow. When it runs, Bubble sets the session cookie and Current User becomes available.

// Example workflow action
Log the user in
Email = Input Email's value
Password = Input Password's value

From this moment, you can show user‑specific pages, run backend workflows using “Current User”, and apply privacy rules.

How to keep sessions secure

• Use Privacy Rules to restrict what each logged-in user can see in the database.
• Turn on Require email confirmation if your app needs verified accounts.
• Use the Only when Current User is logged in condition to protect pages or groups.

How to end a session

To log someone out, run the Log the user out action. This clears their session cookie.

// User clicks “Log out”
Log the user out

How to detect session state

• Use Current User is logged in to control navigation.
• Use When page is loaded and Current User is not logged in to redirect to a login page.
• Use Current User is logged out for conditional UI.

That’s all you need: Bubble handles the technical session layer, and you control login, logout, and privacy rules to manage what users can do during their session.