The end user at the web browser visits the web application. She follows a link or the web application redirects to CAS. So the web application accesses the CAS login URL, presenting the service URL [IETMT:S]. The user interacts with CAS until she convinces it of her identity (e.g., presents a session cookie or posts her username and password into a form). CAS establishes, if not yet established, a secure cookie [IETMT:C] so that CAS can recognize the user on a subsequent request. CAS redirects the user to the web application service URL (S) with the service ticket [IETMT:T] on the URL as the request parameter "ticket". The web application presents the ticket [IETMT:T] to CAS alongside the service identifier [IETMT:S]. CAS responds with the [IETMT:NetID] in the validation response. The application reads this NetID and does whatever it needs to do to establish an application session, service the request.