1

I develop a TYPO3 application which runs in a companies intranet. It is build on a CENTOS 6 platform with a MySQL database (5.1.16) and an Apache webserver (Version 2.2.15). For authentication we use an NTML Apache module mod_ntlm. As server side application language we use PHP.

I have configured the Apache server to use KeepAlive (KeepAlive On). Other settings are set as following:

  • MaxKeepAliveRequests 100
  • KeepAliveTimeout 5

For testing purposes I use a test file/page ("test.php"). It includes a link to a css file. When I access this page on my browser (Mozilla Firefox) and take a look into the servers access log I see following entries:

172.16.xxx.xxx - - [17/Dec/2014:16:39:18 +0100] "GET /test.php HTTP/1.1" 401 401 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:34.0) Gecko/20100101 Firefox/34.0"
172.16.xxx.xxx - - [17/Dec/2014:16:39:18 +0100] "GET /test.php HTTP/1.1" 401 401 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:34.0) Gecko/20100101 Firefox/34.0"
172.16.xxx.xxx - hoermann.klaus [17/Dec/2014:16:39:18 +0100] "GET /test.php HTTP/1.1" 200 188 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:34.0) Gecko/20100101 Firefox/34.0"
172.16.xxx.xxx - - [17/Dec/2014:16:39:18 +0100] "GET typo3conf/ext/theme_bigportal/Resources/Public/CSS/frontend.css HTTP/1.1" 401 401     "http://portal.test.at/test.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:34.0) Gecko/20100101 Firefox/34.0"
172.16.xxx.xxx - - [17/Dec/2014:16:39:18 +0100] "GET /typo3conf/ext/theme_bigportal/Resources/Public/CSS/frontend.css HTTP/1.1" 401 401 "http://portal.test.at/test.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:34.0) Gecko/20100101 Firefox/34.0"
172.16.xxx.xxx - hoermann.klaus [17/Dec/2014:16:39:18 +0100] "GET /typo3conf/ext/theme_bigportal/Resources/Public/CSS/frontend.css HTTP/1.1" 200 71701 "http://portal.test.at/test.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:34.0) Gecko/20100101 Firefox/34.0"

Now my question: Isn't this a faulty behaviour? The second request to the CSS file should not include the CAN transactions, because the established TCP connection is kept alive (due to the "KeepAlive On" setting on Apache), and valid for at least 5 seconds. I understood it this way: The first request needs to be authenticated. After the CAN requests I get a 200 for this resource. Following requests reuse the TCP connection and do not need to be authenticated again.

Any ideas why Apache does this for each and every request on a page? All the time.

0

You must log in to answer this question.

Browse other questions tagged .