iTP Secure WebServer System Administrators Guide (Version 7.5+)

The Session Identifier Specification 1.0 rounds expiration times to approximately 8.5 minute
intervals. The range of expiration times is approximately 8.5 minutes (510 seconds) to 1 year
(about 30 million seconds).
Browser Caching
Some browsers support caching mechanisms that the content server can use to prevent the loss of
tickets. The cached information is called a cookie. You can specify whether you want your server
to take advantage of these mechanisms whenever they are available.
If a Web client supports caching, a Web server can direct the Web client to save arbitrary
information. For ticketing, the content server can direct the Web client to store a ticket in its cache;
then, whenever the Web client sends a request to the server, it automatically sends the cached
information (the ticket).
Caching is particularly valuable if you want to track users across separate sessions. With caching,
a user can exit the Web client or request a resource on a nonticketed server without losing the
ticket.
How Proxy Servers Affect Ticketing
Many Web installations and online services employ a proxy server, which has a job to cache
requests and replies for multiple Web users. Caching can increase performance dramatically for
Web users, but it can have some negative effects on tracking and authentication.
As shown in “Proxies” (page 176), proxies act as intermediaries between a group of Web clients
and Web servers.
Figure 10 Proxies
Cached Requests
and Replies
WebServer WebServer
Proxy Server
WebServer
Web Client
Web Client Web Client Web Client Web Client
When a Web client issues a request in the form of a URL, the proxy first checks its cache to see if
it already has the resource. If so, the proxy returns the resource to the Web client, sometimes
without contacting the Web server at all. If the proxy does not have the requested resource, it
forwards the request to the specified Web server.
The use of proxies prevents an accurate measure of the number of times a Web page is accessed
because there is no way to know how often a proxy short-circuits a request by returning a page
176 Administering Session Identifiers for Anonymous Sessions