Skip to main content

HTTP Session Management
draft-hallambaker-httpsession-03

Document Type Expired Internet-Draft (individual)
Expired & archived
Author Phillip Hallam-Baker
Last updated 2015-04-30 (Latest revision 2014-10-27)
RFC stream (None)
Intended RFC status (None)
Formats
Stream Stream state (No stream defined)
Consensus boilerplate Unknown
RFC Editor Note (None)
IESG IESG state Expired
Telechat date (None)
Responsible AD (None)
Send notices to (None)

This Internet-Draft is no longer active. A copy of the expired Internet-Draft is available in these formats:

Abstract

The HTTP Session Management Mechanism provides a mean of securely establishing a persistent authentication session between a HTTP client and server that does not rely on the presentation of a confidential bearer token. The Session Management Mechanism is intended to provide a replacement for the existing HTTP State Management Mechanism (Cookies) for this purpose. This document defines the HTTP Accept-Session, Set-Session and Session headers and specifies their use to establish symmetric authentication keys and their use to authenticate and verify specific parts of an HTTP message. Other means by which keys used to authenticate the messages are established are outside the scope of this document.

Authors

Phillip Hallam-Baker

(Note: The e-mail addresses provided for the authors of this Internet-Draft may no longer be valid.)