Django user sessions with AWS Load Balancer stickiness turned off

Question

I'm using AWS Elastic Beanstalk with EC2 servers behind an Elastic Load Balancer (ELB).

I have "sticky sessions" on the ELB enabled because that's the only way I can get django user sessions to work correctly. However, during times of peak traffic, this causes problems because the ELB no longer distributes each incoming request evenly. This usually overloads 1 server like a mini DDOS.

What I would like to do is use server-side user sessions where user authentication information is stored in my Redis cache. I've tried setting SESSION_ENGINE to numerous things like:

SESSION_ENGINE = 'redis_sessions.session' 
SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
SESSION_ENGINE = 'django.contrib.sessions.backends.cached_db'

Then when I turn sticky sessions off, I am unable to login because the requests end up going to different servers where some requests are authenticated and others are not. The ones that are not, redirect me back to the login page.

Here are some other relevant settings I have:

INSTALLED_APPS = (
    ...,
    'django.contrib.sessions',
    ...,
)
MIDDLEWARE_CLASSES = (  
    ...,
    'djangosecure.middleware.SecurityMiddleware',
    ...,
    'django.contrib.sessions.middleware.SessionMiddleware',
    ...,
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
    ...,
)

What am I doing wrong? Many thanks.

Workbook

I'm having a similar problem on AWS ECS. If i have multiple docker containers running on a single instance, I get redirected to login often depending on which container picks it up. I'm using multi port mapping to get the most out of my instance but seems to be breaking sessions in django. – Tamie

Answer 1

Are you sure all your webservers are actually connecting to the same shared redis instance, eg: on the network like AWS ElastiCache (and not defaulting to something on their localhosts)?

If you use SESSION_ENGINE = 'django.contrib.sessions.backends.cache' then make sure the cache it uses set to the the redis cache you configured in CACHES, maybe with SESSION_CACHE_ALIAS if not default.

Takin

Answer 2

If you want to have a load balanced implementation of django application across multiple servers, you cannot use the default session authentication method directly as it uses memory as the session store. What happens in this situation is, when you login to one of the instance, this state is stored in memory of that particular server. If your next request goes to a different server, you will be shown as unauthenticated.

The solution here is to use a different mechanism of session storage which can be shared between multiple servers. One example would be to use redis as a session store. Both the servers can then connect to the same instance of redis and have same session state.

The link explains how this can be achieved - http://michal.karzynski.pl/blog/2013/07/14/using-redis-as-django-session-store-and-cache-backend/

Figge