live
Log out? Roll the dice
The logout button works about half the time. Sometimes it logs you into… someone else. Behind an ALB.
The scene
Reported:
- Users click Log out and are still logged in on the next page ~50% of the time.
- Two reports of briefly seeing another user's name in the header after logging out.
- Two app nodes behind an ALB, stickiness off.
- Sessions:
HashMap<String, Session>in each node's memory. The cookie holds onlysid. - Session IDs:
sid = String.valueOf(counter.incrementAndGet()), where each node has its own counter starting at 1. - Logout:
sessions.remove(sid)on whatever node gets the request. The cookie is left in place.
Diagnoses — hidden until the incident closes
Sign in to post your root-cause diagnosis.