What would be good/scalable user session alternative in following scenario:
- users don’t have to have cookies enabled
- URL query string restriction of 255 characters is imposed
- lot of GET requests (no hidden form fields)
- application runs on several servers (web farm)
- some users connect over proxy (same IP)
- users connect over HTTPS
- 50 000 concurrent users
If you can guarantee that the client always connects to the same web server, you can use the SSL ID as a simple session tracking mechanism. Some web servers expose this capability and automatically use it for session tracking when cookies aren’t supported.
The only solution that will work no matter what is to include a session ID in the URL itself. Adding a parameter to the URL is the simplest way to do this, but the ID can be embedded anywhere in the URL, i.e. as part of the path. You would use this ID to fish information about the user out of a database.
You will run into the usual problems, of course, with ID spoofing and having the session database be a bottleneck.