Managing Distributed Sessions

1. Understanding Session Management Strategies

StrategyStorageTrade-offs
Sticky sessionsMemory on one serverSimple; uneven load, lost on restart
Centralized storeRedis/Memcached/DBStateless servers; extra hop
Session replicationReplicate across serversHA; bandwidth overhead
Token (JWT)Client-side, signedStateless; revocation hard

2. Implementing Sticky Sessions

MethodDetail
Cookie-basedLB inserts cookie
IP hashNGINX ip_hash
Application cookieApp-set; LB reads
RisksHot backend; failover loses session

3. Implementing Session Replication

ModeDetail
All-to-allEvery node has all sessions
Buddy / pairReplicate to one peer
Tomcat DeltaManagerMulticast deltas
CostNetwork + memory linear in replicas

4. Implementing Centralized Session Store

Example: Spring Session + Redis

@EnableRedisHttpSession(maxInactiveIntervalInSeconds = 1800)
public class SessionConfig {
    @Bean
    public LettuceConnectionFactory redisConnectionFactory() {
        return new LettuceConnectionFactory(
            new RedisStandaloneConfiguration("redis-host", 6379));
    }
}
StoreDetail
RedisMost common; TTL via EXPIRE
MemcachedVolatile; LRU eviction
DynamoDBManaged, TTL items

5. Implementing Token-Based Sessions (JWT)

PartContent
Header{"alg":"RS256","typ":"JWT"}
PayloadClaims: sub, exp, iat, aud, custom
SignatureHMAC or asymmetric
StorageCookie (HttpOnly, Secure, SameSite) or Authorization header
RevocationShort TTL + refresh token; or revocation list
Warning: Never store secrets in JWT payload — it's only base64-encoded, not encrypted. Use JWE for confidentiality.

6. Handling Session Expiration

TypeDetail
Idle timeoutN minutes since last activity
Absolute timeoutHard cap from creation
Sliding windowRenew on activity
Server-initiatedForce logout (password change)

7. Implementing Session Affinity

MethodDetail
CookieSet by LB or app
Connection (L4)TCP connection pinned
Source-IP hashRisk: NAT collapses many users

8. Understanding Stateless vs Stateful Services

Stateless

  • No per-client state in server
  • Easy scaling, zero-downtime deploys
  • State in token / external store

Stateful

  • Per-client state in memory/disk
  • StatefulSet, persistent volumes
  • Examples: DBs, caches, WebSocket servers

9. Implementing Session Migration

TriggerAction
Node drainPersist sessions; forward to peer
Rolling deployReplicate to replacement before old shutdown
FailoverRecover from centralized store

10. Handling Session Security

ConcernMitigation
HijackingHttpOnly + Secure cookies; HTTPS only
FixationRotate session id on login
CSRFSameSite=Lax/Strict; CSRF tokens
XSSHttpOnly cookies; CSP headers
ReplayShort TTL; nonce / jti claim