RFC 2109 (rfc2109) - Page 2 of 21

HTTP State Management Mechanism

Alternative Format: Original Text Document


RFC 2109            HTTP State Management Mechanism        February 1997


   Hosts names can be specified either as an IP address or a FQHN
   string.  Sometimes we compare one host name with another.  Host A's
   name domain-matches host B's if

   * both host names are IP addresses and their host name strings match
     exactly; or

   * both host names are FQDN strings and their host name strings match
     exactly; or

   * A is a FQDN string and has the form NB, where N is a non-empty name
     string, B has the form .B', and B' is a FQDN string.  (So, x.y.com
     domain-matches .y.com but not y.com.)

   Note that domain-match is not a commutative operation: a.b.c.com
   domain-matches .c.com, but not the reverse.

   Because it was used in Netscape's original implementation of state
   management, we will use the term cookie to refer to the state
   information that passes between an origin server and user agent, and
   that gets stored by the user agent.

3.  STATE AND SESSIONS

   This document describes a way to create stateful sessions with HTTP
   requests and responses.  Currently, HTTP servers respond to each
   client request without relating that request to previous or
   subsequent requests; the technique allows clients and servers that
   wish to exchange state information to place HTTP requests and
   responses within a larger context, which we term a "session".  This
   context might be used to create, for example, a "shopping cart", in
   which user selections can be aggregated before purchase, or a
   magazine browsing system, in which a user's previous reading affects
   which offerings are presented.

   There are, of course, many different potential contexts and thus many
   different potential types of session.  The designers' paradigm for
   sessions created by the exchange of cookies has these key attributes:

      1.  Each session has a beginning and an end.

      2.  Each session is relatively short-lived.

      3.  Either the user agent or the origin server may terminate a
          session.

      4.  The session is implicit in the exchange of state information.




Kristol & Montulli          Standards Track

Web Standards & Support: