0

We develop an React application with an Express NodeJS backend and this application is secured by an authentication using IBM App ID. Everything works fine on the authentication mechanism if the application is deployed on a Cloud Foundry Service with only 1 instance running.

For performance and high availability reason we need to scale up the number of instances. Unfortunately, as soon as we add an instance, we face problems with authentication. We loop over the authentication screen several times before the authentication succeeds and we can access the application.

For information, we use a Cloudant database to store the session. Have you ever encountered this problem and how did you solve it? Thank you for your feedback.

data_henrik
  • 16,724
  • 2
  • 28
  • 49
Mathias
  • 1
  • How do you manage the session cookies? If an app instance is not accepting the identity / session cookies held be the user, the user is forced to login again – data_henrik Mar 24 '21 at 08:16
  • We manage session cookies with the middleware express-session to store all session data on the server and only sessionID into the cookie. – Mathias Mar 24 '21 at 10:59

1 Answers1

0

Technically what you are doing is the right thing.

I've encountered these problems before and first thing is usually local session handling - either the default memory store or some file based session store. You should have this covered, as you say you have sessions in Cloudant, but sometimes when you want to enable local developers running the app, you may need to have some switches to control if the shared store is used, but also if http or https is used. Why http vs https is important, you probably have 'cookie: { secure: true }' which needs to be flip/flopped in that case. Next you might want to http trace the login attempt to see that you don't accidently use another host name than what you begun with. This could easily happen if your CALLBACK url for App ID changes it. These might still not be your reason, and if it is so - then setup that 2 instance environment, save the logs from app servers, http trace from browser and inspect created sessions from Cloudant. There should be only one session created, one url for application used, same session cookie saved in browser. If any of that does not add up - then you need to figure out why not.

jarkko
  • 76
  • 8