Skip to main content
Information Security

Return to Question

Tweeted twitter.com/StackSecurity/status/821169139737829376
Improved formatting
Source Link
Limit
Limit
  • 3.3k
  • 1
  • 19
  • 36

By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is enabled for, say 60 seconds, then:

-any client-server communication will take place over the same connection
-any client-server communication after 60 seconds of inactivity will reinitiate the SSL handshake and then proceed with requests and repsonses.

Also, how is this connected to a user's session inactivity timeouthow is this connected to a user's session inactivity timeout?

By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is enabled for, say 60 seconds, then:

-any client-server communication will take place over the same connection
-any client-server communication after 60 seconds of inactivity will reinitiate the SSL handshake and then proceed with requests and repsonses.

Also, how is this connected to a user's session inactivity timeout?

By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is enabled for, say 60 seconds, then:

-any client-server communication will take place over the same connection
-any client-server communication after 60 seconds of inactivity will reinitiate the SSL handshake and then proceed with requests and repsonses.

Also, how is this connected to a user's session inactivity timeout?

Source Link
Hrishabh Sobti
Hrishabh Sobti
  • 85
  • 1
  • 2
  • 6

What is the security risk of enabling persistent connection (HTTP Keep-Alive)?

By my understanding, the HTTP Keep-Alive header dictates whether the next packet of communication will be sent over the same connection or not, i.e., if the web app runs over SSL, and a Keep-Alive is enabled for, say 60 seconds, then:

-any client-server communication will take place over the same connection
-any client-server communication after 60 seconds of inactivity will reinitiate the SSL handshake and then proceed with requests and repsonses.

Also, how is this connected to a user's session inactivity timeout?