I just examined the headers of HTTP requests and responses regarding to Gmail. First, I submitted username and password and examined the headers. Then deleted an email from inbox and examined again. Many requests and responses were generated during these two main tasks.

My question is, why so many requests and responses are generated for these two main tasks?

And there were a few requests headers (most of them were for images etc.) where cookie is not sent. Then how does server identify me without a session cookie?

I am really thankful if anybody can explain to me what is happening in the headers of this two main tasks.

  • Keep in mind you cannot login to Gmail, you login to Google. When you enter Gmail it will redirect you to a special page in Google that will generate an authentication key and redirect you back to Gmail with that key, so Gmail can determine if you are logged in on Google and if you are, who you are there. So we are talking about at least a couple page loads here. – Havenard Jul 20 '14 at 22:37
  • Keep in mind you cannot login to Gmail, you login to Google - thanks for the new point – AnoAPI Jul 21 '14 at 0:26

Without seeing the headers and specific requests you're referring to, it's only really possible to answer in general terms.

Modern web applications, such as GMail make a large number of requests during operation, not just for actions initiated by the user.

These may be for things like refreshing UI elements or polling for updates for things like chat status.

In terms of why some requests may not have cookies while others do, well in general this happens if the request isn't to the same host as the main sites. A lot of sites use CDNs for hosting static assets (e.g. image files). As these assets aren't confidential or specific to a user, there's no need to restrict them by checking the validity of an HTTP session before providing them.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy