Re: session length when using cookies

From: Hank A. Paulson <hap#spamproof.nospammail.net>
Date: Thu, 03 Sep 2009 10:40:00 -0700


Theoretically, if you are using http (and are closing the connection after each request) and an app generated cookie, the tcp persistence would not matter or come into play - I think.

Take the infamous "AOL user" case, AOL in the past, at least, used multiple gateways with a single user coming from different IPs during the lifetime of a single session. In that case, you can't use tcp connectivity tricks to manage sessions, you have to use cookies. Again, afaik.

A similar situation is the recent discussion of very long sessions for remote desktop - I don't believe tcp persistence came into play there either.

On 9/3/09 10:23 AM, James Little wrote:
> Hank, thanks for the reply. I was not thinking of app-cookie (i.e.
> appsession) load balancing at this stage, but just a SERVERID cookie
> which stores the backend label. I guess the answer is that it depends on
> what cookies the app uses, and what their expiry date is. But what about
> source IP persistence as well? How do we configure the timeout for that?
>
> Thanks,
>
> James
>
>
> On 3 Sep 2009, at 17:47, Hank A. Paulson wrote:
>
>> if you use haproxy with app-generated-cookie based balancing, it will
>> continue to send requests with that cookie to that backend as long as
>> that cookie exists and that backend is up - afaik.
>>
>> If you look at the cookie in a browser tool, what is the expiration time?
>> If it is not, as long as you want you have to change the expiration
>> time in your CMS that is creating the cookie.
>>
>> On 9/3/09 8:15 AM, James Little wrote:
>>> Hi All,
>>>
>>> I'm looking for some advice on how to achieve lengthly (2 hours+)
>>> persistence with cookie insertion. I know that by default the cookies do
>>> not expire, but we are concerned here with the actual session duration.
>>> For example, say we are dealing with a web-based CMS where the user
>>> wants to be logged in for hours, but is not necessarily refreshing the
>>> screen frequently. How do we ensure he stays logged in? I'm aware that
>>> HAProxy does not support http keep-alive. Is the 'clitimeout' setting
>>> the right way to go?
>>>
>>> Also interested in knowing the *default* persistence timeout.
>>>
>>>
>>> Any pointers greatly appreciated.
>>>
>>>
>>> James
>>
>
>
Received on 2009/09/03 19:40

This archive was generated by hypermail 2.2.0 : 2009/09/03 19:45 CEST