Web Technology Basics
HTTP is a stateless protocol. Which of the following correctly describes what this means together with the usual way a website keeps a user logged in?
- AThe server remembers every request that arrived on the same TCP connection, so the user stays logged in as long as the browser does not close the connection
- BHTTP itself has a mechanism that records logged-in users, so the web application does not need to do anything to keep state
- CHTTP itself does not remember how requests relate to each other, so a session ID issued by the server is passed in a cookie, which the browser sends back each time
Show answer and explanation
Answer: C. HTTP itself does not remember how requests relate to each other, so a session ID issued by the server is passed in a cookie, which the browser sends back each time
Stateless means that each request is handled independently and the protocol does not remember the contents of earlier requests. Because the server does not need to keep state, any server can handle a request, which has the advantage of making it easy to add servers. To keep state such as a login, the server passes a session ID with the Set-Cookie header, and the browser automatically attaches it in the Cookie header to requests to the same site. Using the ID it receives, the server looks up the user information (the session) stored on its own side.
- A. Reusing a TCP connection and remembering a login are different things. Connections can be closed midway, and HTTP does not remember earlier requests even on the same connection.
- B. HTTP itself does not record login state, so the application manages it with cookies or tokens.
- C. Correct. Passing a session ID in a cookie ties requests to the user.