Browse All TLS Extensions

session_ticket

TLS Extension Code: 35

Extension Details

Extension Name
session_ticket
Extension Code (Decimal)
35
Extension Code (Hex)
0x0023
RFC Reference
RFC 5077, RFC 8446

What is session_ticket?

The Session Ticket extension enables stateless TLS session resumption. Instead of the server maintaining session state (Session ID resumption), the server encrypts the session state and sends it to the client as a "ticket". When resuming, the client presents the ticket, and the server decrypts it to restore the session. This eliminates server-side session storage, improving scalability. However, it raises privacy concerns as tickets can be used to track clients across connections. Defined in RFC 5077. TLS 1.3 replaces this with PSK (Pre-Shared Key) resumption.

Role in JA3 Fingerprinting

How This Extension Affects Fingerprinting

The session_ticket extension is part of the TLS Client Hello packet that JA3 analyzes to create a unique fingerprint of your browser or HTTP client.

JA3 Construction: JA3 concatenates TLS parameters including extensions in a specific format:
TLS_VERSION,CIPHERS,EXTENSIONS,CURVES,POINT_FORMATS

Different browsers and HTTP clients support different sets of TLS extensions, making this a key differentiator in fingerprinting. The presence, absence, or order of extensions like session_ticket can reveal:

  • Browser type and version (Chrome, Firefox, Safari, Edge)
  • Operating system (Windows, macOS, Linux, Android, iOS)
  • HTTP library (curl, Python requests, Go http.Client, Node.js)
  • Bot detection - automated tools often have distinctive extension sets

Test Your TLS Configuration

See if your browser or HTTP client includes the session_ticket extension in its TLS handshake:

Test Your JA3 Fingerprint

The JA3 tool will show all TLS extensions your client advertises, including session_ticket.

Browser & Client Support

Modern Browser Support:

  • Chrome/Edge: Full support for session_ticket
  • Firefox: Full support for session_ticket
  • Safari: Full support for session_ticket

HTTP Client Libraries:

  • curl: Support varies by OpenSSL/LibreSSL version
  • Python requests: Limited TLS extension control
  • curl_cffi: Can mimic browser TLS configurations
  • Scrapfly API: Automatically matches real browser TLS fingerprints

Related TLS Resources

TLS Extensions
Testing Tools

Technical References