REST Session Handling

[krishna_ozarks]

Need best practice recommendations for handling sessions for REST calls. We currently just pass userid/pwd basic authentication in every call. Will this cause additional sessions in Service Now? Do we need to retain the session Id and include that in subsequent calls for the same user?

[BenPhillipsSNC]

Hi Vamsi,

You're right, as we note in:

Web Services Integrations Best Practices - ServiceNow Wiki

"If the Web Services client is not session-aware, large numbers of new sessions are created in the ServiceNow instance, slowing everything down and wasting memory."

Which is why in REST API - ServiceNow Wiki we describe that REST supports cookies for binding to the existing session.

Thanks

[BenPhillipsSNC]

Hi,

Can you mark this response as Helpful or as answering the question? The post still is in a state of "Not answered."

thanks

[Alex North]

Hi Krishna,

I just wanted to endorse Ben's comment here, in that you should re-use your sessions with integrations wherever possible. There is a greater than zero resource cost for each session which is created by your integration. Depending on the session timeout configuration on your instance, you may see some performance degradation. This will be spotted on stats.do as constantly low memory / frequent garbage collection (seen on xmlstats.do or in the performance graphs in the instance).

Alex North

Technical Architect | ServiceNow

[Mwatkins]

Hi Krishna,

I definitely agree with Alex and Ben here about the need for considering the impact of session re-use. However, I will play devil's advocate here to some degree. Session re-use also has tradeoff, namely that session re-use requires effectively pinning the integration to a node. Alex alluded to this consideration when he mentioned your "session timeout configuration". I've written a KB article in HI (with borrowed work from Alex, actually - by his permission of course!) that talks about some best practices when implementing an inbound integration into ServiceNow, including a discussion about configuring session re-use.

Troubleshooting inbound integrations performance

Best regards!