Backend Systems · Cluster
Session and State
Statelessness, stickiness, and stores.
- 01 How a Session Identifier Binds Requests to Server State What the opaque string in a session cookie actually denotes, how much entropy it needs, and why the identifier and the record it points at have separate lifetimes.
- 02 Cookie Scope, Attributes, and Transport Rules The exact matching rules that decide whether a browser attaches a session cookie to a request, and how Domain, Path, Secure, HttpOnly, and SameSite narrow that decision.
- 03 Signed Cookie Tokens and the Limits of Statelessness How a signed token encodes session facts, what the signature actually guarantees, and which operations stop being possible once the server keeps no record.
- 04 Load Balancer Session Affinity and Its Failure Modes How sticky routing is implemented at layer 4 and layer 7, why consistent hashing limits the damage of a node loss, and which failures affinity cannot prevent.
- 05 Key Design and Eviction in External Session Stores How session records are keyed, sized, and expired in Redis and Memcached, and why an eviction policy can turn a memory shortage into a login outage.
- 06 Session Fixation, Rotation, and Revocation Why authenticating in place hands an attacker a valid session, how rotation must be sequenced to survive concurrent requests, and what revocation can and cannot reach.
- 07 Read-Your-Writes Across Replicated Session Stores Which consistency guarantees a session actually needs, why a replica read can undo a rotation, and how version tokens and home-region ownership keep a user from seeing their own past.
- 08 Concurrent Mutations and Versioned Session Records Why whole-record writes lose updates when a browser issues requests in parallel, and how compare-and-set, fencing tokens, and delta operations keep the record coherent.
- 09 Sharding Session Data and the Size Ceiling How session keys are partitioned across nodes as the store grows, why resharding is safer at a partition layer, and what a large cookie costs on every request.
- 10 Refresh Token Rotation and Replay Detection How rotating refresh tokens limit the value of a stolen credential, why a used token presented twice means compromise, and how a grace window keeps honest clients from tripping the alarm.