Hi guys,

We ran into a small problem and wanted to share our findings.

We introduced http load balancers upstream of our apache servers to balance
the requests.

The result of this is that new user session were created randomly and that
was an issue for us.

The session package does a look up by IP and sessionID to identify a given
user.
But with the load balancers, the incoming IP is always the IP of one of the
LB.

So Rivet session was creating new session for that user, who was already
logged in.

We made a quick hack to disable the IP check and that solved the issue.
We could have made the request sticky but we didn't want that in production.

So should we make this session lookup by IP and sessionID optional with
some type of flag?

Thank you
Brice.

Reply via email to