Site Analysis Note 19

1. Static Resource HTTP Response Header

cache-control:public, max-age=30758400cf-cache-status:HITcf-ray:1afc29518836124f-HKGcontent-encoding:gzipcontent-type:text/cssdate:Wed, 28 Jan 2015 09:28:42 GMTexpires:Tue, 19 Jan 2016 09:28:42 GMTlast-modified:Sun, 25 Jan 2015 04:38:08 GMTserver:cloudflare-nginxstatus:200 OKvary:Accept-Encodingversion:HTTP/1.1

Noteworthy:

(1) it uses 'cloudflare-nginx' for static resources.

cloudflare is free CDN, its official doc says: CloudFlare does not cache HTML, we only cache static files like images, CSS or Javascript. So if your HTML content is constantly changing, CloudFlare will not affect this content.

(2) gzip applied.

(3) cache applied.

2. Dynamic Page HTTP Response Header

Cache-Control:no-cache, no-storeContent-Encoding:gzipContent-Length:158Content-Type:text/html; charset=utf-8Date:Wed, 28 Jan 2015 09:54:47 GMTExpires:-1Last-Modified:1/28/2015 5:54:47 AM GMTPragma:no-cacheVary:Accept-EncodingX-Powered-By:ASP.NET

Noteworthy:

(1) ASP.NET architecture.
(2) No cache for dynamic content.

3. Cookie

4. Data Structure

Neither JSON, nor YAML, what the hell is it?

5. Dynamic Domain Name

域名泛解析, wildcard DNS, catch-all subdomain, wildcard subdomain.

6. Login Procedure

STEP 1. Obtain the login Token (First Post)

In order to get this token, you have to open the home page and parse it to extract the token. So, you can't post a login request directly, open home page is inevitable.

Input, access home page.

Output, token.

STEP 2. Post the Login Request (Second Post)

Input, all login parameters, including the token mentioned above.

Output, intermediate page containing the dynamic subdomain URL.

During this step process, the site may process our request by a dedicated login server, this server probably has some policy or strategy to dispatch the new session to theapplication server farm, some betting accounts may access to fast server, some don't.

STEP 3. Redirect to the Dynamic Subdomain (Third Post)

Input, necessary parameters 

Output, cookie and login-name(I think it's something like session-id)