.NET applications behind load balancer generating different Session IDs?

Question

We have a collection of .NET sites which are hosted on two effectively identical webservers, with a simple load balancer splitting requests between the two. Everything was working fine until we had a hardware failure on one server and replaced it. Now, we're having session problems as people are being logged out of the applications whenever the load balancer switches the server they're connecting to.

Applications on both servers are configured to use SQLServer for session state, and have identical machineKey and sessionState values in web.config. e.g:

<configuration>
  <system.web>
    <machineKey validationKey="..." decryptionKey="..." validation="SHA1" decryption="AES" />
    <sessionState mode="SQLServer" stateNetworkTimeout="30" stateConnectionString="..." allowCustomSqlDatabase="true" sqlConnectionString="..." cookieless="false" timeout="1441" />
  </system.web>
</configuration>

The paired applications are also setup identically in IIS as far as I can tell: same URL, same application pool name, even same path on disk.

However, a request to the same site on each server (by IP) creates two unique SessionID values (with the same cookie name in the browser).

Is there something else I should be setting/checking to generate matching Session IDs on both servers?

DaveD DaveD · Accepted Answer · 2012-03-19T18:57:02

Eventually found my answer on serverfault (why oh why are these all separate sites and user accounts?): https://serverfault.com/questions/288981/load-balanced-iis-7-5-web-server-asp-net-session-state-problem

In short: under Advanced Settings of each site in IIS, there's a numeric ID which is configurable but apparently auto-incremented from 1 in order of site creation on that server. These IDs are used in the ASPStateTempApplications table, and were different between our servers, resulting in different Session IDs.

.NET applications behind load balancer generating different Session IDs?

1 Answers