Session Timers in the Session Initiation Protocol (SIP)
Extracted elements (25)
Proxies that require session timers SHOULD record-route so they remain in the signaling path and receive refresh requests. The rationale is that a proxy that inserts Session-Expires but does not record-route will never observe whether refreshes are occurring, defeating the purpose of requesting session timers.
The 30-minute (1800 second) RECOMMENDED minimum for Session-Expires was chosen because 95% of phone calls are shorter than this duration and because small session intervals cause excessive messaging traffic and increase 'glare' (simultaneous re-INVITE/UPDATE from both sides). It is a SHOULD rather than MUST because exact values depend on network factors including bandwidth, latency, and application scenario.
The extension is designed to work when only one UA supports it. If only the UAC supports it and the UAS returns a 2xx without Session-Expires, the UAC may still apply the timer unilaterally by acting as if the response contained Session-Expires with the request's value and refresher='uac'. This asymmetric operation enables incremental deployment.
A re-INVITE or UPDATE sent for purposes other than session refresh also has the effect of refreshing the session and MUST be processed per the session timer rules. The UPDATE method is RECOMMENDED over re-INVITE for refreshes when the peer supports it (indicated by Allow: UPDATE), and UPDATE SHOULD NOT contain an offer while re-INVITE SHOULD.
A proxy MUST NOT insert a Min-SE header field or modify an existing one in a proxied request if that request contains a Supported header field with value 'timer'. This protects against denial-of-service attacks.
A proxy MUST NOT insert or modify the value of the 'refresher' parameter in the Session-Expires header field in a request. It also MUST NOT set the Session-Expires value lower than the Min-SE value in the request.
A UAC that supports the session timer MUST include a Supported header field with option tag 'timer' in each request (except ACK), even if it is not requesting use of the session timer for that session.
If a session refresh request transaction times out or generates a 408 or 481 response, the UAC sends a BYE as per RFC 3261 Section 12.2.1.2. The side not performing refreshes that does not receive a refresh before session expiration SHOULD send a BYE slightly before expiration; the minimum of 32 seconds and one third of the session interval is RECOMMENDED.
If a UAC must perform refreshes and seeks to continue the session beyond the session expiration, it MUST generate a refresh before the session expiration. It is RECOMMENDED that this refresh be sent once half the session interval has elapsed.
If the refresher parameter in the 2xx response is 'uac', the UAS MUST place a Require header field with value 'timer' into the response. If the refresher is 'uas' and the UAC indicated support, the UAS SHOULD include Require: timer.
SIP entities MUST be prepared to handle Session-Expires header field values of any duration greater than 90 seconds. The absolute minimum for the Session-Expires header field is 90 seconds; entities that insert it SHOULD NOT choose values less than 1800 seconds (30 minutes).
Stateless proxies MUST NOT attempt to request session timers. Proxies that ask for session timers SHOULD record-route, as they won't receive refreshes if they don't.
The Min-SE header field value MUST NOT be less than 90 seconds when present in a request or response. When absent, its default value is 90 seconds.
The UAS MUST set the value of the refresher parameter in the Session-Expires header field in the 2xx response according to Table 2, which defines refresher assignment based on whether the UAC supports the extension and the refresher parameter in the request.
When a proxy inserts a Session-Expires header field into a response (because the UAS did not support session timer but the UAC did), it MUST set the 'refresher' parameter to 'uac' and MUST add the 'timer' option tag to a Require header field in the response.
When a proxy's session expiration time is reached, it MAY remove associated call state and MAY free resources, but MUST NOT send a BYE (unlike UAs).
When a UAC has received a 422 response to a session refresh request on a dialog, or received a session refresh request containing Min-SE, it MUST insert the Min-SE header field into subsequent session refresh requests on that dialog. The value MUST be the largest Min-SE seen across all 422 responses or received requests on that dialog.
The 422 (Session Interval Too Small) response code is generated by a UAS or proxy when a request contains a Session-Expires header field with a duration below the element's minimum timer. The 422 response MUST contain a Min-SE header field with the server's minimum timer.
The Min-SE header field indicates the minimum value for the session interval in delta-seconds. It appears in INVITE or UPDATE requests and MUST NOT appear in responses except for 422 responses. Its default value when absent is 90 seconds.
The Session-Expires header field conveys the session interval (delta-seconds) for a SIP session. It is placed only in INVITE or UPDATE requests and 2xx responses to those requests. A compact form 'x' is defined. It includes an optional 'refresher' parameter with value 'uac' or 'uas'.
The 'timer' option tag is registered for use in Supported, Require, and Proxy-Require header fields. In Supported it indicates support for the session timer extension; in Require in a request it mandates UAS support; in Require in a response it mandates UAC processing of Session-Expires.
RFC 4028 registers two new SIP header fields: Min-SE (no compact form) and Session-Expires (compact form: 'x'). It also registers the 422 response code ('Session Interval Too Small') and the 'timer' option tag in the IANA SIP registries.
Inside attacks: rogue proxies or UAs could attempt to force rapid session refreshes. The Min-SE mechanism prevents this by ensuring all elements on the path can enforce a minimum timer floor, and proxies will reject requests with too-small session intervals via 422.
Outside attacks: an element that can observe and modify requests or responses in transit can force rapid session refreshes. Since session timer header fields are hop-by-hop, it is RECOMMENDED to use TLS and the SIPS URI scheme for hop-by-hop integrity. Proxies that record-route and request session timer SHOULD record-route with a SIPS URI.
Session timer state includes session interval, session expiration, and identity of the refresher, bound to a dialog. The session expiration is set to the time of the last 2xx response plus the session interval. It is updated on each successful session refresh. If no 2xx contains Session-Expires, the session timer is inactive ('turned off').