The big picture
HTTP is stateless: where does state live?
The server does not remember you between requests. The ways to fake memory, and their costs.
Understand the concept
In HTTP every request stands alone: at protocol level the server does not know what the same user did a second earlier. Being signed in, a basket or a language preference must therefore be carried with every request or stored somewhere and found by a key.
There are three basic approaches. Cookies: the browser stores small values given by the server and sends them automatically. Tokens: the client carries a credential (for example a JWT) in the Authorization header. Server-side sessions: the cookie holds only a random session id and the real data lives on the server (memory, Redis, a database).
Statelessness makes scaling easy: because each request is independent, a load balancer can send it to any server. The condition is that state must not live in one server’s memory. An application keeping sessions in memory starts showing users as randomly ‘signed out’ the moment a second server is added.
Session design decides scaling, security and how sign-out behaves.
Keeping user state in one server’s memory and then trying to scale out.
One topic. Three levels of depth.
Set-Cookie: ataberk-theme=dark; Path=/; Max-Age=31536000
// sonraki her istekte:
Cookie: ataberk-theme=darkThis site’s theme preference travels with every request in a cookie.
This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.
Try it yourself first.
You added a second server and users fall back to the sign-in screen every few clicks. What do you check first?
Show the solution and explanation
Oturum veya kimlik doğrulama anahtarlarının sunucuya özel bellekte tutulup tutulmadığı:
- in-memory session
- sunucuya özgü Data Protection anahtarlarıWhen requests land on different servers, a server that does not share state or cookie-protection keys cannot recognise the user.