nancyfx session on load balanced web server

Question

Nancyfx uses a cookie based session. It encrypts the cookies using a unique key it generates when the app starts. If you were to have the app across more than one server (load balanced), every app instance would generate its own key at start up and use that to encrypt and decrypt cookies.

Which means when a request is directed between servers for the same user session, a cookie saved from the first machine can't be read on the next machine. I tried solving the problem by providing nancy with a custom key generator that always produces the same key, but the problem still exists.

Is there some thing fundamental I am missing here, or is there another solution?

Answer 1

When you enable it you pass in a CryptographyConfiguration, one of the ones we provide in the box is a password based one, which is what you use in load balanced scenarios or when you want to maintain the validity across app restarts.

There's more info on the crypto stuff here:

https://github.com/NancyFx/Nancy/wiki/The-cryptography-helpers

And about the load balancing side here:

https://github.com/NancyFx/Nancy/wiki/Forms-Authentication