# Can not use session on rotating ports: what it means > "Can not use -session- on rotating ports" means the port, not the username, decides stickiness. We had written the opposite, until we asked the gateway. Source: https://mosaicbrowser.com/blog/session-token-on-rotating-port ## A session token on a rotating port is a 400, not a no-op "Can not use -session- on rotating ports" means the port, not the username, decides stickiness. We had written the opposite, until we asked the gateway. ![400: A session token on a rotating port, beside a screenshot: a proxy check result in Mosaic: latency, exit address, ISP, HTTPS tunnelling and reputation](https://mosaicbrowser.com/covers/session-token-on-rotating-port.webp) "Can not use -session- on rotating ports" is a proxy gateway telling you that the port you dialled changes its exit on every connection, and that it will not pretend to hold one for you. The username asked for a sticky session; the port does not do sticky sessions; the answer is a `400`. We had written down, in our own notes, that this could not happen. ## What our notes said Mosaic reads a proxy seller's options out of the username: country, city, a session id, how long the session lives. For Cat Proxies we built that parser from five real endpoints and the seller's dashboard. The dashboard labels some ports as rotating and some as sticky, and our notes argued with it. The paragraph read, more or less: the port does not decide stickiness, an endpoint on 10000 carrying `-session-` is as sticky as one on 12000, and believing the labels would put a control in the editor that changes nothing. That was a plausible model of how a residential gateway works. Most sellers we had read put everything in the username, so why would the port matter? It was also never tested. We had reasoned about a third party's system and written the result down as if we had measured it. ## Can not use session on rotating ports: what the gateway said So we asked it. One account, one host (`resi-us.catproxies.com`), each port with and without a session token: ``` 9000 + -session- 400 "Can not use -session- on rotating ports" 9000 no session exits PA, then AZ on the next connection 10000 + -session-ab12cd34 97.238.70.34 … and 97.238.70.34 again 10000 + -session-zz99yy11 152.13.118.218, a different id, a different exit 11000 + -session- SOCKS5 authentication failed 11000 no session exits PH, then US on the next connection 12000 anything no answer at all on this account ``` The dashboard was right. Port 9000 rotates, and a session token there is a hard error, not something quietly ignored. Port 10000 holds one exit per session id, and a different id gets a different exit. Port 11000 is the SOCKS5 gateway and also rotates. The port picks the protocol and whether an exit can be held, and the username only works inside what the port allows. The error is the useful part. A gateway that silently ignored the token would have been worse: the profile would open, the exit would change under it with every connection, and a logged-in site would watch one account arrive from Pennsylvania and then Arizona inside a minute. A `400` with a sentence in it is an answer you can act on. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Provider minting](https://mosaicbrowser.com/features/proxy-providers) ## What changed in Mosaic Three things, each one small. 1. **The editor moves the port with the switch.** In the Cat Proxies panel, turning on **Sticky session** on a rotating port moves the gateway to the sticky one for that protocol. Saving a configuration that fails at every launch is the thing we refuse to do. If the port is changed back by hand, a red banner names the port, quotes the gateway's sentence and says which port to use instead. 2. **The proxy check stops on a refusal.** The check retries a dead exit on a fresh session, because a residential session that reaches nothing usually stays dead. This sentence is different. The gateway answered; it will answer the same way next time. Retrying it three times turned an instant, actionable answer into a forty-second wait for the same words, so the check now returns it on the first attempt. 3. **"Rotate" means a new session, not a rotating port.** People who ask for rotation usually want a different exit each time they open a profile, and one exit for the whole time it is open. That is a fresh session id on each launch, on a sticky port. A saved proxy can do that with `rotateOnLaunch`. On a rotating port it does nothing, because the port already rotates harder than this would and a token there is the `400` above. ## Did it work the first time? No The rotation setting was stored, the API reported it stored, and three launches in a row came out of the same exit. One mapper copied a saved proxy into the launcher's config field by field, and the new field was not in its list. A dropped field and an honoured one look identical from outside. Launching three times and reading the exit found it in a minute: ``` rotation on 35.132.79.114 · 38.45.221.194 · 71.199.128.198 rotation off 69.245.49.160 · 69.245.49.160 · 69.245.49.160 ``` All three rotated launches stayed on `America/Chicago`, because Mosaic matches the timezone to each launch's measured exit. The setting is off by default, and the editor says what it costs: a profile that is signed in somewhere and turns up from a new city every launch tells that site something no fingerprint work takes back. ## Ask the endpoint The lesson is not about Cat Proxies. A seller's gateway is somebody else's system, and the only reliable description of it is what it answers. Our notes had a model; the gateway had a status code. We now treat a claim about a third party the way we treat a claim about a detector: it is a guess until something has been sent and the reply has been read. You can do the same check on any proxy line in [the proxy checker](https://mosaicbrowser.com/tools/proxy-checker), which reports the exit and the step that failed. We have only measured this at Cat Proxies. If another seller sends you the same sentence, the two ways out are the same: point the line at the port that seller documents as sticky, or take the session token out and accept a new exit per connection. Why a profile needs one steady exit in the first place, matched to its timezone and language, is in [Introducing Mosaic](https://mosaicbrowser.com/blog/introducing-mosaic), and the case for a browser per account is in [what an anti-detect browser is](https://mosaicbrowser.com/guides/what-is-an-anti-detect-browser). ## Questions ### What does "Can not use -session- on rotating ports" mean? The gateway port you connected to hands out a new exit on every connection, and it refuses a username that asks it to hold one. Move to the seller's sticky port, or take the session token out of the username. ### Does the port decide whether a proxy session is sticky? At the seller we measured, yes. Port 9000 rotated on every connection and refused a session token with a 400. Port 10000 held one exit per session id and gave a different exit for a different id. ### Will retrying the connection fix the error? No. It is a refusal, not a dead exit, so every retry gets the same sentence back. Mosaic's proxy check stops on it at once instead of trying three times. ### What is the difference between a rotating port and rotating sessions? A rotating port changes exit on every connection, which breaks anything longer than one request. Rotating sessions keep one exit for a whole browser run and pick a new session id next time, on a sticky port. ## Related [Introducing Mosaic, an anti-detect browser that lives on your machine](https://mosaicbrowser.com/blog/introducing-mosaic): Mosaic runs its own Chromium, draws each profile from a real machine and matches it to the proxy exit. Profiles stay on disk. One plan, no per-profile fees. [Reading a proxy seller's grammar off one pasted line](https://mosaicbrowser.com/blog/a-sellers-grammar): Proxy sellers put country, session and lifetime in the username. Mosaic reads the grammar off the line you paste and keeps every token it does not know. [Four 504s on one session: rotate, don't retry](https://mosaicbrowser.com/blog/rotate-dont-retry): On a sticky residential proxy a session token is an exit, so retrying it asks a dead exit three more times. Rotate to a fresh session instead. [Provider accounts: one gateway line, one exit per profile](https://mosaicbrowser.com/features/proxy-providers): Paste your proxy seller's gateway line once and Mosaic mints a separate session for every profile, so each one browses from its own exit address.  [Peru, Brazil and Bahrain in three requests](https://mosaicbrowser.com/blog/three-countries-three-requests): A rotating proxy with no country pin can exit in a different country on every request. Fine for a stateless scrape, fatal to a profile that keeps one timezone. [The residential IP several detectors already knew](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy): A residential proxy can be detected as a proxy because it is one. On one Wichita exit, FingerprintJS and incolumitas never loaded in three rounds. [What an expiring sticky session looks like from inside a browser](https://mosaicbrowser.com/blog/sticky-session-expiry-symptoms): A sticky session expired on our proxy: the browser showed tunnel errors, the check a healthy proxy in another state. Neither said expired. ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.