How does a session affine loadbalancer of Amazon AWS know that a session cookie is expired?
amazon-ec2, java, load-balancing, session-cookies
Solution
Typically an application-aware (layer 7) LB would not maintain a (large) map of sessions. It might:
inject its own cookie into the first response to the client (and the client would re-send that on subsequent requests, so the LB could determine the target web server)
rewrite a well-known session cookie (such as JSESSIONID) by, for example, appending information to it that identifies the target web server (and which the LB would strip out before presenting to the web server on subsequent requests)
Key point is that the LB does not maintain the session to target map. That information resides within cookies residing in each client.
I believe that AWS does #1 (using a cookie named AWSELB).
Problem
If I use an HTTP load balancer with application-controlled session stickiness (in this case Amazon's AWS) the load balancer obviously has to remember all session cookies and their target instances in a map. This global map will/must therefore keep the "session-cookie to instance" relations. If the web app user decides to close the browser, the session will die silently on the app server after the session-timeout. This means in turn that the load-balancer still has the "session-cookie to instance" relation in his global map. Since this mapping is now useless and the session cookie has no expiry date it cannot but should be garbage-collected (to free the resources). My questions are: How does a load balancer in general deal with this scenario without running out of resources? How deals, in particular, an Amazon AWS load balancer with this scenario without running out of resources?