Web Technology Basics
Three application servers are placed behind a load balancer, which distributes requests to them in turn (round robin). The session information of a logged-in user is stored only in the memory of the server that handled the login. Which of the following is an appropriate pair of a likely problem and its countermeasure?
- AWhen a request goes to another server, the session is not found and the user appears to be logged out. Keep sessions in a shared store that all servers can use
- BThe three servers issue the same session ID separately and the IDs collide. Make session IDs short sequential numbers so that users can remember them
- CThe load balancer cannot read cookies, so HTTPS stops working. Stop encrypting the traffic between the load balancer and the servers
Show answer and explanation
Answer: A. When a request goes to another server, the session is not found and the user appears to be logged out. Keep sessions in a shared store that all servers can use
If session information exists only in one server's memory, a server that receives the next request cannot identify the user when the request is distributed to it. One countermeasure is to keep sessions in a shared store that every server can read and write (an in-memory data store or a database). Another is session persistence (sticky sessions), which keeps sending the same user's requests to the same server, but sessions are lost if that server stops and the load also tends to become uneven. Keeping servers stateless makes it easy to add or remove servers.
- A. Correct. With a shared store, every server can use the same session.
- B. Session IDs are made long enough and random so that they cannot be guessed. Making them short increases the risk of impersonation.
- C. The session problem has nothing to do with HTTPS. Stopping encryption only lowers security.