ok, I've google'd my butt off, and dug thru DNS & BIND, and cannot find the answer to this question. Does a 302 server response force another DNS lookup of the "Location" even if the 302 points to the same URL?

Some background on the issue: I run hardware load balancers and am running into a login process that is sometimes stuck in a "loop"; i.e., successful authentication clears the fields and brings an empty login screen back up, a bad auth correctly shows "access denied". My working theory (based on packet captures) is that the login process is handing the browser back a 302 response, which is causing the browser to do another lookup of http://internal.prod.server/application_context/login.jsp and letting the browser jump to a different GSLB address.

Unfortunately, this stopped being obviously broken over the weekend so I can't get a definitive packet capture showing the bad behavior. Semi-unfortunately, I'm one of those crazy network wonks who can't simply accept that it's not broken anymore and needs to definitively say what the original issue was...

edit: load balanced request

; <<>> DiG 9.7.0-P1 <<>> ps.svc.cfx
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31149
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2

;ps.svc.cfx.            IN  A

ps.svc.cfx.     10  IN  A

ps.svc.cfx.     3600    IN  NS  gslb.cn.example.com.

gslb.cn.example.com.    21600   IN  A
gslb.cn.example.com.    21600   IN  A

;; Query time: 10 msec
;; WHEN: Mon Aug  2 13:01:21 2010
;; MSG SIZE  rcvd: 108

The responder in this example is a cluster of BIND servers running internal/external views and sync'd off a hidden master.

  • 2
    Any form of random load balancing with stateful sessions isn't a good idea. – Chris S Aug 2 '10 at 15:31

No, there's nothing special about a 302 response that should force a DNS lookup. However, depending on how the local DNS settings are configured, a DNS result could expire at any time. So you have to allow for the possibility of a lookup after the first request, and before the second one (caused by the 302).

To be conservative, you need to allow for a DNS lookup each request.

  • +1 - specifically, the local DNS are clustered BIND servers (behind the same hardware load balancers), with NS delegations to the GSLB devices for the load-balanced records. Additional info added to OP – Greeblesnort Aug 2 '10 at 18:01
  • so, while a 302 does not specifically cause another DNS lookup, if the normal TTL has expired, it will force another one. This would be contrary to the behavior we've actually seen in browsers. Supporting documentation: The browser - in order to speed up performance - maintains a cache of results which in the abscence of any other information is timed out after 30 minutes in the case of MS Explorer and 1 minute in the case of the Mozilla family (configurable in both cases) - from netwidget.net/books/apress/dns/info/minimum-ttl.html – Greeblesnort Aug 2 '10 at 18:19
  • Yes, you're right that some browsers cache for performance (possibly longer than the TTL). However, you clearly can't rely on that for the correctness of your implementation. For one thing, it is trivial to disable Firefox's DNS cache manually or with an addon. – Matthew Flaschen Aug 2 '10 at 19:18
  • 1
    In other words, in the real world, you cannot rely on the client caching the DNS response, nor can you rely on the client NOT caching the DNS response. – coneslayer Aug 2 '10 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.