306

I want to know the difference between sticky- and non-sticky sessions. What I understood after reading from internet:

Sticky : only single session object will be there.

Non-sticky session : session object for each server node

1

2 Answers 2

698

When your website is served by only one web server, for each client-server pair, a session object is created and remains in the memory of the web server. All the requests from the client go to this web server and update this session object. If some data needs to be stored in the session object over the period of interaction, it is stored in this session object and stays there as long as the session exists.

However, if your website is served by multiple web servers which sit behind a load balancer, the load balancer decides which actual (physical) web-server should each request go to. For example, if there are 3 web servers A, B and C behind the load balancer, it is possible that www.mywebsite.com is served from server A, www.mywebsite.com is served from server B and www.mywebsite.com/ are served from server C.

Now, if the requests are being served from (physically) 3 different servers, each server has created a session object for you and because these session objects sit on three independent boxes, there's no direct way of one knowing what is there in the session object of the other. In order to synchronize between these server sessions, you may have to write/read the session data into a layer which is common to all - like a DB. Now writing and reading data to/from a db for this use-case may not be a good idea. Now, here comes the role of sticky-session.

If the load balancer is instructed to use sticky sessions, all of your interactions will happen with the same physical server, even though other servers are present. Thus, your session object will be the same throughout your entire interaction with this website.

To summarize, In case of Sticky Sessions, all your requests will be directed to the same physical web server while in case of a non-sticky load balancer may choose any webserver to serve your requests.

As an example, you may read about Amazon's Elastic Load Balancer and sticky sessions here : http://aws.typepad.com/aws/2010/04/new-elastic-load-balancing-feature-sticky-sessions.html

13
  • 9
    @TJ- what will happen if one node will unavailable? Nov 8, 2015 at 15:25
  • 26
    In most of the cases, the session will be lost. In case of AWS ESB If an instance fails or becomes unhealthy, the load balancer stops routing request to that instance, instead chooses a new healthy instance based on the existing load balancing algorithm. The load balancer treats the session as now "stuck" to the new healthy instance, and continues routing requests to that instance even if the failed instance comes back.
    – TJ-
    Nov 9, 2015 at 2:22
  • 11
    According to what informations does the LoadBalancer make a HTTP session sticky? Especialy on HTTPS connections this issue becomes interesting. Do you feed the LB with the web servers private key, so that it is able to break up the SSL connection and fetch the HTTP session? Or does the LB simply make use of the client IP adress? In this case, what about proxy server where multiple clients use the same IP-address? Or even worse, mobile clients, where the IP-address changes frequently? Or is there even a better technique for that? Thanks
    – g000ze
    Feb 1, 2016 at 14:12
  • 7
    Yes, you are absolutely correct. In order to make use of "x-forwarded-for" header or a sticky-cookie in this context, SSL Termination needs to be used and hence, the request needs to be decrypted at the LB.
    – TJ-
    Feb 3, 2016 at 3:51
  • 5
    @g000ze When dealing with applications that are not served directly to the internet, I believe it's common to enable TLS only on the outermost proxy server. (A load balancer can be regarded, perhaps over simplistically, as a special type of proxy server, that may pass the request on to any of multiple server.) Traffic between the load balancer and the other servers will occur on a local, secured network, and it is therefore often not necessary to encrypt it, or if it needs to be encrypted, a self signed certificate can be sufficient (since the proxy can be configured to trust it).
    – jpmc26
    Feb 20, 2016 at 1:34
1

Let's say the user sends a request to get its profile, there won't be anything in the memory of our web application instance. we get the user profile from DB nit before sending the response, we save the data in the memory of let's say Instance3. But the next request from the same user can go to any instance.

When the request first comes to Instance3, that time it will create a session that will have a session id. when the response is sent to the client, the client is supplied with a cookie. so next time this client makes a request, this cookie will be attached to the request, the load balancer will look at the cookie, and the load balancer will know that that request has to be forwarded to Instance3. This is sticky session solution. Its downside is what if Instance3 goes down? the load balancer will route the request to other instances but they do not have a cache. All the users stored in Instance3 will have high latency. This will impact the reliability of your system.

If you store sessions in all instances, now you would have memory issues. Let's say if an instance could store 100 user sessions and you have 3 instances, you would be able to store 300 sessions. But if each instance stores each session, you will be able to store only 100 sessions in all of your 3 instances. So this will impact the scalability of your application.

sticky and non-sticky sessions are components of stateful replication. If you want higher scalability you do not cache anything on your web application instance, your web instance will hit the DB with every request but this will cause high latency.

A better way is stateless replication where you do not store anything on your application instance but instead, you use server-side caching (memcached/redis)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.