Cross-session correlation links actions that belong to the same business flow, even when they run on different channels or devices (for example, web, mobile app, and WebView—a web page embedded in a native mobile app). This article explains how cross-session correlation works and what your app needs to do to enable it.
Your backend generates a correlation ID for the flow and passes it with every action, on every device. Mosaic groups all evaluated actions that share the same correlation ID and compares them across devices to assess risk for the whole flow, without adding friction for the user.
Cross-session correlation is available since Web SDK 1.20.0 and is supported on Android, iOS, React Native, Flutter, and Cordova. It's currently available in the EU region only and must be enabled for your tenant. Contact your Transmit Security representative to enable it.
Once your actions are linked, you get:
- No changes to your user flow: You don't need to add screens, prompts, or codes. Your backend generates the correlation ID and shares it with each device through a channel you already control, so the user never sees, enters, or manages it.
- Unified risk assessment: Mosaic evaluates each action against the latest evaluated action from every other device in the flow.
- Cross-session anomaly detection: Mosaic detects anomalies across the flow based on IP address, such as an unexpected distance between devices or impossible travel.
Your backend is responsible for generating the correlation ID and sharing it with every device in the flow.
- Generate a correlation ID. When the flow starts (for example, a login or a transaction), your backend generates a unique ID for it, such as a UUID or a base64url string.
- Share the correlation ID with each device. Use a channel you control to deliver the ID to each device, for example, a QR code, a push notification, a deep link, or URL parameters of a WebView.
- Pass the correlation ID with every action. On each device, include the correlation ID when you trigger an action, using the SDK or the backend API.
- Request a recommendation for every action. Mosaic only correlates actions that have been evaluated. Actions that are triggered but don't receive a recommendation are excluded.
You don't need to chain devices. All devices that use the same correlation ID join the same group, regardless of how many devices are involved (for example, web → mobile identity verification → web).
// Correlation ID generated by your backend for this flow
await drs.triggerActionEvent('[ACTION_TYPE]', { correlationId: '[CORRELATION_ID]' });For the full method signatures, see triggerActionEvent() and Trigger an action.
| Limit | Value |
|---|---|
| Correlation ID format | Up to 128 characters. Letters, digits, ., _, :, and -. Spaces aren't supported. Standard base64 (with +, /, or =) isn't supported, so use a UUID or base64url instead. An ID in a different format isn't used for correlation, but the action is still evaluated. |
| Time window | 30 minutes after the latest device joins the group. This value can be configured per tenant. |
| Retention of evaluated actions | 1 hour |
| Group size | A group includes up to 10 devices, including the device that performs the action. |
- Web to mobile (identity verification via QR code): The user starts a flow on the web, scans a QR code with their phone to complete identity verification on mobile, and returns to the web.
- Mobile to WebView: A native mobile app opens a WebView to complete an authentication or verification step.
- Multi-domain web: A flow spans multiple web domains that belong to the same organization.