How to Manage User Sessions in Bubble

In Bubble, every page has access to a built-in data source called 'Current User'. When someone logs in, Current User points to their User record in the database. When no one is logged in, Current User is empty. You can access any field on the User data type through Current User — for example, 'Current User's email' or 'Current User's name'. This object is available in dynamic expressions, conditions, and workflows on every page without any setup.

To protect a page from unauthenticated access, add a 'Page is loaded' workflow event. Add the condition 'Only when Current User is logged out'. As the action, choose 'Go to page' and select your login page. This redirects anyone who is not logged in. For the reverse (redirecting logged-in users away from the login page), add a similar workflow with 'Only when Current User is logged in' redirecting to the dashboard. You can also use the 'User login status changes' event to catch users whose sessions expire while on a page.

Use Current User in dynamic expressions to personalize content. For a welcome message, set a text element's content to 'Welcome, Current User's first_name'. For showing only the user's own data, add a constraint in your searches: 'Do a search for Orders where creator = Current User'. In Repeating Groups, this constraint ensures users only see their own records. Combine this with Privacy Rules (Data tab → Privacy) for server-side security.

Add a 'Log out' button to your navigation. Create a workflow on the button click with two steps: Step 1 — 'Log the user out' (Account action). Step 2 — 'Go to page' targeting your login or landing page. The logout action clears the session token from the browser, and Current User becomes empty immediately. Any page that checks for Current User being logged in will now redirect to login.

Bubble sessions are shared across all tabs in the same browser. If a user logs out in one tab, they are logged out in all tabs. However, the other tabs will not automatically redirect — they still show the page until it refreshes or a 'User login status changes' event fires. To handle this, add a 'User login status changes' workflow on protected pages that redirects to login when the user becomes logged out. This catches cross-tab logout scenarios.

Bubble sessions persist indefinitely by default — users stay logged in even after closing the browser. To implement a session timeout, use a 'Do when condition is true' workflow that checks if the user has been inactive for a set period. Store the 'last activity' timestamp in a custom state, update it on page interactions, and compare it to Current date/time. When the difference exceeds your timeout (e.g., 30 minutes), trigger the 'Log the user out' action and redirect to login.