Subject: RTSP: 1. Use of Cookies for session maintenance

From: Rob Lanphier <[email-masked]>
Date: Thu, 17 Apr 1997 13:39:43 -0700

The first issue discussed was the possible use of
HTTP-style cookies for managing core RTSP server
state (see RFC 2109 for details about HTTP Cookies).
This is contrary to the latest draft (draft02), which
uses the "Session:" field to accomplish this.

The proposed cookie-style method would involve the
server sending Set-Cookie: Session="123"; Version=1;
Path = "/twister" and for the client to return later
Cookie: Session = "123"; \$Version=1; \$Path =
"/twister". In the response to the CLOSE message, the
server would simply send Set-Cookie: Session="123";
Version=1; Max-Age=0 to get rid of the cookie on the
client side. Cookies also have a time-out, so that a
server may limit the lifetime of a session at will.

There was no detectable support for using cookies for
the core RTSP state maintenence. It was generally
felt that cookies were overkill for what was being
accomplished. Furthermore, it was stated that cookies
were intended as a generalized state mechanism
independent of the core operation of the server,
whereas the state mechanism needed for this is core
to the operation of the server.

---
Rob Lanphier               Voice: (206)674-2322         Fax: (206)674-2699
Program Manager-Protocols                         Email: [email-masked]
Progressive Networks-Home of RealAudio            Web: http://www.real.com
For more information on firewalls:       http://www.real.com/firewall.html
For more information on RTSP:               http://www.real.com/prognet/rt