| HTTP |
|---|
 |
| Request methods |
| Header fields |
| Response status codes |
| Security access control methods |
| Security vulnerabilities |
HTTP persistent connection, also calledHTTP keep-alive, orHTTP connection reuse, is the idea of using a singleTCP connection to send and receive multipleHTTP requests/responses, as opposed to opening a new connection for every single request/response pair. The newerHTTP/2 protocol uses the same idea and takes it further to allow multiple concurrent requests/responses to be multiplexed over a single connection.
Under HTTP 1.0, connections should always beclosed by the server after sending the response.[1]
Since at least late 1995,[2] developers of popular products (browsers, web servers, etc.) using HTTP/1.0, started to add an unofficial extension (to the protocol) named "keep-alive" in order to allow the reuse of a connection for multiple requests/responses.[3][4]
If the client supports keep-alive, it adds an additional header to the request:
Connection: keep-alive
When the server receives this request and generates a response, if it supports keep-alive then it also adds the same above header to the response. Following this, the connection is not dropped, but is instead kept open. When the client sends another request, it uses the same connection.
This will continue until either the client or the server decides that the conversation is over and in this case they omit the"Connection:" header from the last message sent or, better, they add the keyword "close" to it:
Connection: close
After that the connection is closed following specified rules.
Since 1997, the various versions of HTTP/1.1 specifications acknowledged the usage of this unofficial extension and included a few caveats regarding the interoperability between HTTP/1.0 (keep-alive) and HTTP/1.1 clients / servers.[5]
In HTTP 1.1, all connections are considered persistent unless declared otherwise.[5] The HTTPpersistent connections do not use separate keepalive messages, they just allow multiple requests to use a single connection. However, the default connection timeout of Apache httpd 1.3 and 2.0 is as little as 15 seconds[6][7] and just 5 seconds for Apache httpd 2.2 and above.[8][9] The advantage of a short timeout is the ability to deliver multiple components of a web page quickly while not consuming resources to run multiple server processes or threads for too long.[10]
Keepalive makes it difficult for the client to determine where one response ends and the next response begins, particularly during pipelined HTTP operation.[11] This is a serious problem whenContent-Length cannot be used due to streaming.[12] To solve this problem, HTTP 1.1 introduced achunked transfer coding that defines alast-chunk bit.[13] Thelast-chunk bit is set at the end of each response so that the client knows where the next response begins.
According toRFC 7230, section 6.4, "a client ought to limit the number of simultaneous open connections that it maintains to a given server". The previous version of the HTTP/1.1 specificationstated specific maximum values but in the words of RFC 7230 "this was found to be impractical for many applications... instead... be conservative when opening multiple connections". These guidelines are intended to improve HTTP response times and avoid congestion. If HTTP pipelining is correctly implemented, there is no performance benefit to be gained from additional connections, while additional connections may cause issues with congestion.[14]
If the client does not close the connection when all of the data it needs has been received, the resources needed to keep the connection open on the server will be unavailable for other clients. This affects both server's availability and the availability of resources on the server, with the degree of impact depending on the server's architecture and configuration.
Also arace condition can occur where the client sends a request to the server at the same time that the server closes the TCP connection.[15] A server should send a 408 Request Timeout status code to the client immediately before closing the connection. When a client receives the 408 status code, after having sent the request, it may open a new connection to the server and re-send the request.[16] Not all clients will re-send the request, and many that do will only do so if the request has anidempotent HTTP method.
All modern web browsers includingChrome,Edge,Firefox,Opera (since 4.0),[17] andSafari use persistent connections.
In Firefox, the number of simultaneous connections can be customized (per-server, per-proxy, total). Persistent connections time out after 115 seconds (1.92 minutes) of inactivity which is changeable via the configuration.[18]
Python'srequests library containsrequests.Session(), which establishes a persistent HTTP connection, thereby allowing the underlying TCP connection to be reused, which can result in a significant performance increase.[19]