Solved

In what cases will server send empty session id during TLS handshake

Posted on 2016-08-16
3
137 Views
Last Modified: 2016-09-03
HI,
I was reading : https://tools.ietf.org/html/rfc5246
And came across this line :
The server
      may return an empty session_id to indicate that the session will
      not be cached and therefore cannot be resumed.


This i also saw happening in one of our company servers which sent : Session ID length: 0  in TLS record.
Why will any server do that. Isnt it always beneficial to give the option to cache the session. So the next time the client
wants to connect it can be done faster ?

Thanks
0
Comment
Question by:Rohit Bajaj
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 62

Accepted Solution

by:
gheist earned 300 total points
ID: 41761534
If apache does not have properly cinnected session id storage it does so (i.e on first connection it says it suppots sessions, on connection client sends session ID for next, apache neuters that because it is not found in its non-existant database.
0
 
LVL 22

Assisted Solution

by:eeRoot
eeRoot earned 200 total points
ID: 41764544
Likely to let the client app know that the session will not be held open.  An application developer may use this field to determine if re-auth is needed while the user session or application is still running.
0
 
LVL 62

Expert Comment

by:gheist
ID: 41765664
https://www.ietf.org/rfc/rfc5077.txt

   The server uses a zero-length SessionTicket extension to indicate to
   the client that it will send a new session ticket using the
   NewSessionTicket handshake message described in Section 3.3.  The
   server MUST send this extension in the ServerHello if it wishes to
   issue a new ticket to the client using the NewSessionTicket handshake
   message.  The server MUST NOT send this extension if it does not
   receive one in the ClientHello.
0

Featured Post

Instantly Create Instructional Tutorials

Contextual Guidance at the moment of need helps your employees adopt to new software or processes instantly. Boost knowledge retention and employee engagement step-by-step with one easy solution.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Microservice architecture adoption brings many advantages, but can add intricacy. Selecting the right orchestration tool is most important for business specific needs.
Make the most of your online learning experience.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …

695 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question