These three statements are indeed true regarding session-based authentication:
A. HTTP sessions are treated as a single user: Session-based authentication can treat multiple HTTP sessions as a single user, providing a consolidated view of user activity.
C. It can differentiate among multiple clients behind the same source IP address: Session-based authentication is capable of distinguishing between multiple clients behind the same source IP address.
D. It requires more resources: Session-based authentication may require more resources compared to simpler authentication methods due to the additional processing involved in tracking and managing user sessions.
For A: Each session-based authenticated user is counted as a single user using their authentication membership (RADIUS, LDAP, FSSO, local database etc.) to match users in other sessions. So one authenticated user in multiple sessions is still one user.