1

With Session resumption in TLS/HTTPS the client stores the sessionID or the session ticket and uses it the next time it wants to communicate with the server. I am trying to find where the browser stores this information. I am not able to find much information about that. Can anyone help out or point me in the correct direction?

  • It is stored in process memory only so no sessions can be resumed between restarts of the browser. How much more detail you need? – Steffen Ullrich Jul 24 '15 at 17:58
  • Ah ok. That is what I was hoping to hear. Is it ever persisted to disk on the client? – user220201 Jul 24 '15 at 18:24
2

What the client actually stores is the set of security parameters, the most important part of which being the master secret: this is the secret value shared with the server, obtained from a previous handshake. The session ID or session ticket is just a value used to reference that master secret(*).

The master secret is very sensitive (knowing it allows decrypting all the data in the session...) so the client is supposed to be extra careful with it. In practice, the client stores it in RAM only; you won't find it in any file, and it disappears when the client process is terminated (process termination, in the case of Web browsers, mostly equates with closing all browser windows). Session ID and tickets are stored along with the master secret, in the same emplacement, since they do not make sense without that master secret.

(In modern Web browsers, there are usually several process, but they talk to each other, so, for this discussion, they can be considered together as "the browser process".)

On the server side, RAM-based storage is also common, but some servers allow storage in a database or in some other mechanism so that the master secret may be shared between several front-ends. This is needed for some kinds of load balancing mechanisms. Of course, writing the master secret on any physical medium is a potential source of leak, so this kind of game shall be done only with great care.

(*) Well, the session ticket is something a bit more complex than that, but the gist of the idea remains valid: for the client, the master secret is outside of the session ticket.

  • Thanks. I understand the session resumption from the server point of view but I am not clear on how long its going to be persisted on the client. Is the session resumption information ever persisted to disk? Specifically in the browser context. – user220201 Jul 24 '15 at 18:25
  • Never mind. The master secret cannot/should not be written to disk anyway and so storing the session ticket does not make any sense and there are bunch of reasons to not do this. So I don't expect it to be. – user220201 Jul 24 '15 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.