Return-Path: Delivered-To: apmail-jakarta-tomcat-dev-archive@apache.org Received: (qmail 30533 invoked from network); 10 Dec 2001 23:00:18 -0000 Received: from unknown (HELO nagoya.betaversion.org) (192.18.49.131) by daedalus.apache.org with SMTP; 10 Dec 2001 23:00:18 -0000 Received: (qmail 26683 invoked by uid 97); 10 Dec 2001 23:00:15 -0000 Delivered-To: qmlist-jakarta-archive-tomcat-dev@jakarta.apache.org Received: (qmail 26608 invoked by uid 97); 10 Dec 2001 23:00:13 -0000 Mailing-List: contact tomcat-dev-help@jakarta.apache.org; run by ezmlm Precedence: bulk List-Unsubscribe: List-Subscribe: List-Help: List-Post: List-Id: "Tomcat Developers List" Reply-To: "Tomcat Developers List" Delivered-To: mailing list tomcat-dev@jakarta.apache.org Received: (qmail 26597 invoked from network); 10 Dec 2001 23:00:13 -0000 Sender: ekr@rtfm.com To: "Tomcat Developers List" Subject: Re: [Fwd: using SSL_SESSION_ID for session tracking, anyone done it?] References: Reply-to: EKR Mime-Version: 1.0 (generated by tm-edit 7.108) Content-Type: text/plain; charset=US-ASCII From: Eric Rescorla Date: 10 Dec 2001 15:00:02 -0800 In-Reply-To: Joel Roth-Nater's message of "Mon, 10 Dec 2001 14:40:59 -0500" Message-ID: Lines: 21 X-Mailer: Gnus v5.6.45/XEmacs 20.4 - "Emerald" X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N X-Spam-Rating: daedalus.apache.org 1.6.2 0/1000/N Joel Roth-Nater writes: > My idea is to let Apache handle SSL traffic, but pass the SSL_SESSION_ID > through mod_webapp to Tomcat. Tomcat could then use it to track its > sessions without cookies or URL-rewriting. Before I start writing the > code myself, I wonder if anyone has tried to do it. If you're going to do this you're going to have to be prepared for the case where a client reconnects but doesn't resume a previous session. There's no guarantee in SSL that merely because a C/S pair have communicated previously (Even recently) that they will resume that previous session. Clients and servers can flush the session cache at any time. Session IDs aren't really a complete substitute for cookies. -Ekr -- [Eric Rescorla ekr@rtfm.com] Author of "SSL and TLS: Designing and Building Secure Systems" http://www.rtfm.com/ -- To unsubscribe, e-mail: For additional commands, e-mail: