Size of client-side sessions

[Marvin S. Addison]

> I have working code that stores the V3 user session, including a variable
> number of authentication results for SSO, in a cookie.

I intend to review that code in the next week or so.

> the URL-encoded form after encryption and
> base64-encoding is only 472 bytes for a session plus one password-based
> authentication result.

That sounds fairly impressive at first glance.

> Most of that is the authentication result, so storing additional
> factors/methods in a session is probably ~400 bytes typically unless a lot
> of custom data were involved, which is best avoided for this use case.

What's the cost of each additional SPSession object? Is there any data 
out there on the number of SP sessions per IdP session so you can get a 
sense on size over time?

> Some more shrinking is possible, plus this is using JSON, so it's still
> text based and could be smaller with a binary encoding.

I learned of MsgPack [1] recently and wanted to mention it. Looked 
promising for use cases where efficiency is preeminent.

M

[1] http://msgpack.org/