Keep Sessions Working Across Multiple App Servers

A login that works on server A and disappears on server B is local memory pretending to be shared session state. A load balancer only reveals the assumption.

This guide belongs to reel R107. Comment BALANCE for the matching module and runnable starter.

Define the boundary before building

Input: session creation code, cookie settings, signing keys, load balancer policy, server count, shared stores, health checks, and failure scenarios.

Output: a session state map, shared-store or signed-token decision, key distribution checks, affinity tradeoffs, multi-instance tests, and failure runbook.

The starter keeps exact checks in code and gives Claude only the reviewable drafting work. Dry-run is the default. Live mode can call Anthropic's Messages API, but it still returns a draft and performs no external action.

Paste this boundary into Claude Code before asking for implementation:

Workflow: Keep Sessions Working Across Multiple App Servers
Input: session creation code, cookie settings, signing keys, load balancer policy, server count, shared stores, health checks, and failure scenarios
Output: a session state map, shared-store or signed-token decision, key distribution checks, affinity tradeoffs, multi-instance tests, and failure runbook

Map the trigger, strict input fields, deterministic code checks, Claude drafting step, approval gate, failure queue, and saved evidence. Use null for missing facts. Do not change code or call an external service yet.

The modules that matter

Map session state

Trace login creation, cookie contents, server lookup, expiry, logout, key rotation, and every in-process cache. Mark which data another healthy instance needs on the next request.

Choose the state boundary

Use a shared session store when the server must revoke and update state centrally. Use signed stateless tokens only when their expiry, revocation, size, and key-rotation tradeoffs fit. Sticky sessions are an optimization, not durability.

Test more than round robin

Alternate requests across two instances, kill each instance, interrupt the shared store, rotate signing keys with overlap, expire a session, and log out. Keep non-idempotent request retries out of the test.

Rules worth keeping beside the code

Assume the next request can reach a different healthy server.
Keep signing keys consistent and protected across instances.
Use sticky sessions only as a documented tradeoff, not hidden state recovery.
Test instance loss, store failure, expiry, rotation, and logout.

The dangerous version is storing the only session copy in process memory, logging tokens, rotating keys without overlap, trusting affinity as durability, or retrying non-idempotent requests. The pack deliberately stops at a draft so a person can inspect those boundaries before enabling anything real.

Test the ugly paths

Login survives alternating instances.
Instance loss does not end a valid session.
Logout invalidates the next request.
Old and new signing keys overlap safely.
Store failure returns a controlled error.
Health checks remove a bad instance.

The final verification is concrete: Alternate one test user's requests across two instances, kill each instance in turn, rotate keys safely, and confirm login, expiry, and logout remain correct.

Use this prompt to turn the evidence into acceptance tests:

Design tests for Keep Sessions Working Across Multiple App Servers using only the attached fictional fixtures.
Cover the normal path, missing input, malformed input, a repeated event, a permission failure, a dependency failure, and the named safety boundary.
For each test return: input, expected state, prohibited side effect, and evidence to save.
Do not execute external actions.

Run the pack locally

The ZIP is a complete Node 22 starter with no third-party npm dependency. It includes an importable n8n webhook, Docker Compose, GitHub Actions validation and manual-run workflows, deterministic samples, and tests.

npm test
npm run validate
npm run sample
cp .env.example .env
docker compose up --build

Only set WORKFLOW_MODE=live, ANTHROPIC_API_KEY, and ANTHROPIC_MODEL after the dry-run output and tests make sense for your system. Keep real secrets in the environment, never in the n8n export.

Download the runnable pack

Start with the fictional dry-run. It validates the input and returns a reviewable draft without changing code, production data, customer accounts, or an external service.

Before enabling a real action

Replace every fictional fixture, assign the approval owner, define the duplicate key, set a timeout and retry rule, and save the original evidence. Then test one failure on purpose. If the workflow cannot stop visibly and replay safely, it is not ready to act.