Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

ok, I've google'd my butt off, and dug thru DNS & BIND, and cannot find the answer to this question. Does a 302 server response force another DNS lookup of the "Location" even if the 302 points to the same URL?

Some background on the issue: I run hardware load balancers and am running into a login process that is sometimes stuck in a "loop"; i.e., successful authentication clears the fields and brings an empty login screen back up, a bad auth correctly shows "access denied". My working theory (based on packet captures) is that the login process is handing the browser back a 302 response, which is causing the browser to do another lookup of http://internal.prod.server/application_context/login.jsp and letting the browser jump to a different GSLB address.

Unfortunately, this stopped being obviously broken over the weekend so I can't get a definitive packet capture showing the bad behavior. Semi-unfortunately, I'm one of those crazy network wonks who can't simply accept that it's not broken anymore and needs to definitively say what the original issue was...

edit: load balanced request

; <<>> DiG 9.7.0-P1 <<>> ps.svc.cfx
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31149
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;; QUESTION SECTION:
;ps.svc.cfx.            IN  A

;; ANSWER SECTION:
ps.svc.cfx.     10  IN  A   192.168.125.202

;; AUTHORITY SECTION:
ps.svc.cfx.     3600    IN  NS  gslb.cn.example.com.

;; ADDITIONAL SECTION:
gslb.cn.example.com.    21600   IN  A   172.19.1.200
gslb.cn.example.com.    21600   IN  A   172.18.1.200

;; Query time: 10 msec
;; SERVER: 172.18.1.2#53(172.18.1.2)
;; WHEN: Mon Aug  2 13:01:21 2010
;; MSG SIZE  rcvd: 108

The 172.18.1.2 responder in this example is a cluster of BIND servers running internal/external views and sync'd off a hidden master.

share|improve this question
2  
Any form of random load balancing with stateful sessions isn't a good idea. –  Chris S Aug 2 '10 at 15:31

1 Answer 1

up vote 7 down vote accepted

No, there's nothing special about a 302 response that should force a DNS lookup. However, depending on how the local DNS settings are configured, a DNS result could expire at any time. So you have to allow for the possibility of a lookup after the first request, and before the second one (caused by the 302).

To be conservative, you need to allow for a DNS lookup each request.

share|improve this answer
    
+1 - specifically, the local DNS are clustered BIND servers (behind the same hardware load balancers), with NS delegations to the GSLB devices for the load-balanced records. Additional info added to OP –  Greeblesnort Aug 2 '10 at 18:01
    
so, while a 302 does not specifically cause another DNS lookup, if the normal TTL has expired, it will force another one. This would be contrary to the behavior we've actually seen in browsers. Supporting documentation: The browser - in order to speed up performance - maintains a cache of results which in the abscence of any other information is timed out after 30 minutes in the case of MS Explorer and 1 minute in the case of the Mozilla family (configurable in both cases) - from netwidget.net/books/apress/dns/info/minimum-ttl.html –  Greeblesnort Aug 2 '10 at 18:19
    
Yes, you're right that some browsers cache for performance (possibly longer than the TTL). However, you clearly can't rely on that for the correctness of your implementation. For one thing, it is trivial to disable Firefox's DNS cache manually or with an addon. –  Matthew Flaschen Aug 2 '10 at 19:18
1  
In other words, in the real world, you cannot rely on the client caching the DNS response, nor can you rely on the client NOT caching the DNS response. –  coneslayer Aug 2 '10 at 19:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.