Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I just examined the headers of HTTP requests and responses regarding to Gmail. First, I submitted username and password and examined the headers. Then deleted an email from inbox and examined again. Many requests and responses were generated during these two main tasks.

My question is, why so many requests and responses are generated for these two main tasks?

And there were a few requests headers (most of them were for images etc.) where cookie is not sent. Then how does server identify me without a session cookie?

I am really thankful if anybody can explain to me what is happening in the headers of this two main tasks.

share|improve this question

migrated from security.stackexchange.com Jul 21 at 8:44

This question came from our site for Information security professionals.

    
Keep in mind you cannot login to Gmail, you login to Google. When you enter Gmail it will redirect you to a special page in Google that will generate an authentication key and redirect you back to Gmail with that key, so Gmail can determine if you are logged in on Google and if you are, who you are there. So we are talking about at least a couple page loads here. –  Havenard Jul 20 at 22:37
    
Keep in mind you cannot login to Gmail, you login to Google - thanks for the new point –  AnoAPI Jul 21 at 0:26

1 Answer 1

up vote 8 down vote accepted

Without seeing the headers and specific requests you're referring to, it's only really possible to answer in general terms.

Modern web applications, such as GMail make a large number of requests during operation, not just for actions initiated by the user.

These may be for things like refreshing UI elements or polling for updates for things like chat status.

In terms of why some requests may not have cookies while others do, well in general this happens if the request isn't to the same host as the main sites. A lot of sites use CDNs for hosting static assets (e.g. image files). As these assets aren't confidential or specific to a user, there's no need to restrict them by checking the validity of an HTTP session before providing them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.