Every time a user authenticated with a Basic Auth header calls the REST API or do a Webdav information, Tuleap generates a "long session" and store the information in the session table. It can lead to a massive session which in turn can lead to performance issues.

There is no need to create such a session in this situation since the authentication is only supposed to live for the duration of the request.