Resending cookies should be unnecessary

[joostfarla]

The current documentation states:

To work together with load-balanced environments consumers SHOULD resend any cookies as defined in RFC 6265. As stated in the “Authentication” section any Basic Auth authentication header MUST be resend as the session referenced by the cookie MAY expire.

It shall be noted that OCS endpoints MUST behave properly regardless whether cookies are resent or not.

The above statement is probably intended to enable use of sticky sessions in a load-balanced environment. In a RESTful architecture, all requests between client and server are stateless. Stateless requests contain all the necessary information for the server to understand the meaning of the request, including authentication headers. Because each request is self-containing and does not depend on any previous interaction, the server (or any intermediate layer) can treat each request independently and should therefore not store session state. This is the reason why sticky sessions are meaningless and should be avoided. Sticky sessions reduce scalability because the requests can be spread less evenly between server nodes. It also makes failover scenarios more complex.

[LukasReschke]

The above statement is probably intended to enable use of sticky sessions in a load-balanced environment

At the moment this is actually the case because some implementations do use sessions for caching expensive operations.

One example of this is when accessing a password protected shared element, in that case the element may be stored encrypted using bcrypt and when accessing the share using base64encode(shareId:sharePassword), verifying the password is expensive as it may be stored using bcrypt etc.

Sure. Could be solved otherwise on the implementers side so I'm just dropping my 2 cents here and explain why it was added on that document like that :-)

[joostfarla]

@LukasReschke Thanks for clarifying! I can understand this helps in tuning performance.

However, what you describe: a) will probably apply for one specific implementation b) should not be the client's concern

Therefore I think it should not be part of the generic specification. Apart from the discussion whether this should be included or not, (re-)sending cookies is generally not a standard practice for consuming APIs.

[labkode]

I agree wit you @joostfarla I think very specific implementation details should be left out of the spec

[glpatcern]

Hi there, I'm trying to review what was left "To be discussed": this issue was taken into account some time in the past, as there's no more reference to such implementation details in the spec.