In what cases will server send empty session id during TLS handshake

HI,
I was reading : https://tools.ietf.org/html/rfc5246
And came across this line :
The server
      may return an empty session_id to indicate that the session will
      not be cached and therefore cannot be resumed.


This i also saw happening in one of our company servers which sent : Session ID length: 0  in TLS record.
Why will any server do that. Isnt it always beneficial to give the option to cache the session. So the next time the client
wants to connect it can be done faster ?

Thanks
Rohit BajajAsked:
Who is Participating?
 
gheistConnect With a Mentor Commented:
If apache does not have properly cinnected session id storage it does so (i.e on first connection it says it suppots sessions, on connection client sends session ID for next, apache neuters that because it is not found in its non-existant database.
0
 
eeRootConnect With a Mentor Commented:
Likely to let the client app know that the session will not be held open.  An application developer may use this field to determine if re-auth is needed while the user session or application is still running.
0
 
gheistCommented:
https://www.ietf.org/rfc/rfc5077.txt

   The server uses a zero-length SessionTicket extension to indicate to
   the client that it will send a new session ticket using the
   NewSessionTicket handshake message described in Section 3.3.  The
   server MUST send this extension in the ServerHello if it wishes to
   issue a new ticket to the client using the NewSessionTicket handshake
   message.  The server MUST NOT send this extension if it does not
   receive one in the ClientHello.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.