Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

HTTP(S) is stateless, right? But if I go to some site via HTTPS, I assume I don't need an SSL handshake for every single page request. Is it a combination of SSL session cache and cookies?

share|improve this question

1 Answer 1

A SSL session spans several SSL connections (e.g. TCP connections which got upgraded to SSL) and their lifetime is determined by the servers SSL stack. It is usually not directly related to the user session which is determined by the web application and spawns several HTTP requests. These multiple HTTP requests can be sent inside SSL connection (which might have the same SSL session but does not need to) or TCP session without SSL or both. User sessions are usually maintained with HTTP level cookies, while SSL sessions have a similar mechanism, but bound to the SSL protocol.

share|improve this answer
    
For example, in nginx the session cache lifetime is specified in ssl_session_timeout directive. –  Tero Kilkanen May 4 at 10:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.