Re: [regext] Comments to the feedback about epp-over-http

["Thomas Corte (TANGO support)" <[e-mail]>]

Hello Mario,

On 3/31/22 13:52, Mario Loffredo wrote:

> Hi James,
> 
> For what I have understood, your implementation is based on the 
> assumption that once the HTTP Connection is established, it is used for 
> the transit of all the HTTP requests of an EPP session, starting from the 
> Login and ending with the Logout.
> 
> Consequently, you rely on keeping the HTTP connection alive as long as 
> the EPP session works. Correct?
> 
> If so, in my opinion, that is a wrong assumption.
> 
> Clients should not be forced to keep alive the HTTP connections if HTTP 
> allows to maintain HTTP sessions alive across a sequence of HTTP  
> connections.
> ...

I might be wrong (it was hard to follow the entire discussion, mostly due 
to the lack of consistent e-mail quoting in the thread), but I don't 
think there really any disagreement here between James and you.

As James speaks of HTTP Session Cookies in many places, I don't think 
he's suggesting that the connection management should be required to make 
use of any HTTP keepalive features. Instead, I think that you're both 
agreeing that the EPP "session" over HTTP is simply managed by an initial 
cookie given to the client, which he'll need to send along with any 
subsequent request to indicate that it belong to the same session. This 
also means that, unlike with TCP, an EPP session over HTTP can indeed 
survice a server restart, as long as the server can retrieve sessions 
from permanent storage after its restart.

I think the only point of contention here is when exactly the cookie is 
supposed to be returned by the server, namely

a) at the time the very first request without a session cookie is 
received (i.e., when the EPP client sends a <hello>?) OR
b) only after the first <login> command is received with correct credentials

My preference would be a) as it more closely resembles the TCP transport 
(where the connection itself is established before the first valid <login>).

Best regards,

Thomas

-- 
TANGO REGISTRY SERVICES® is a product of:
Knipp Medien und Kommunikation GmbH
Technologiepark                             Phone: [phone]
Martin-Schmeisser-Weg 9                       Fax: [phone]
D-44227 Dortmund                       E-Mail: [e-mail]
Germany