Storing a session using cookies or http session variables for a scalable solution? -
i have 1 web app under login process stores userid in http session variable(after confirmation of course!). i'm not using session variables other 1 retrieve information user. don't know if 1 scalable solution me yet. server reserve memory this? better use cookies instead?
if using multiple application servers (now or in future), believe http session variable dependent server user on (correct me if i'm wrong), in case, can find "sticky session" solution locks user particular server (e.g. ec2's load balancers offer this: http://aws.amazon.com/about-aws/whats-new/2010/04/08/support-for-session-stickiness-in-elastic-load-balancing/ ).
i recommend using cookie (assuming logic above right), should make sure have sort of security measure on users can't change cookie , gain access user's account. example, hash string w/ secret key , user id check server-side confirm has not been tampered with.
Comments
Post a Comment