session ticket
also: TLS session ticket, session resumption token, stateless session resumption
A session ticket is a cryptographic token issued by a server that allows a client to resume a previous TLS/SSL session without performing a full handshake, reducing latency and computational overhead.
Session tickets are an optimization mechanism in TLS (Transport Layer Security) that enable clients to resume encrypted connections quickly. Instead of renegotiating all cryptographic parameters, the server encrypts the session state into a ticket and sends it to the client, which stores it locally.
When the client reconnects, it presents the ticket back to the server. If the server can decrypt and validate it (using its secret key), the session resumes immediately without a full TLS handshake. This is especially valuable for HTTPS connections, where it reduces latency and CPU usage on both client and server.
Session tickets are defined in RFC 5077 and work alongside traditional session resumption methods. Example: A web browser visiting a site, receiving a session ticket, then returning hours later—it can present that ticket for faster reconnection rather than redoing the entire cryptographic negotiation.