How to use session management with Load Balancer in Asp.Net

Question

I have four different server and a load balancer. I want to use captcha control. I did something with it this way:

I created a handler.ashx to create the captcha image. This handler is used in the Main page. I keep the captcha control password in session while creating the captcha control. Then I compared password typed by the user with the password in the session. It works very well, but only on one server.

It doesn't run correctly with four servers. Although the user enters the correct password every time, it sometimes matches with the session password and sometimes doesn't match. I think the problem reason is this:

For Example :

A,B,C and D are the four servers. The load balancer routes the first request to A server. Which opens the main page from A server and creates password '123456'. This is stored in session on A server. Then user typed in the password and clicked button. Now the load balancer routes this request to the B server. Because session in B Sever is null, the passwords don't match.

My web.config has this,

<sessionState mode="StateServer" stateConnectionString="tcpip=127.0.0.1:42424"/>

But It still doesnt work.

What should I do ?

Solution 1

So first thing (just to make sure) - I believe that this connection string is just an example because 127.0.0.1 is localhost and it wouldn't have chance to work ;).

Now I will assume that you have chosen server A for you state server. Please check following things:

• "ASP.NET State Service" is up and running on the server A (it's disabled by default, you can check that in Administrative Tools --> Services)
• the stateConnectionString in servers B, C and D is "tcpip=[Server A IP Address or Network Name]:42424" (it can be 127.0.0.1 only on server A)
• servers can communicate between each other using TCP/IP via port 42424 (firewalls etc.)

Please remember that if you have changed configuration of "ASP.NET State Service" on server A to not use default port (42424), you must reflect that in your connection strings.

Sometimes it's easier to configure "SQL Server Mode" instead of "State Server Mode" so you might want to consider that. You can find more details here.

Solution 2

You need to use StateServer or SqlServer for managing the session state and they should be out of your firewall network that is used to balance the load.

http://www.hanselman.com/blog/LoadBalancingAndASPNET.aspx