We're having several issues with users getting logged out and/or not being able to sign in to our Django application. We have a single database, multiple front end servers, and a nginx load balancer using ip_hash, and are experiencing two problems, I'm not sure if they are related.
The first is that many users will get logged out if their hits move from one frontend server to another, for instance if one is taken down for maintenance. Just using the standard Django database session storage and auth package so it seems like this shouldn't be an issue.
The second is that a few users are having problems signing in. After they have been authenticated, (and confirmed that their sessionid matches one for their user in the db), the site then responds to their requests as if they are not signed in. They can try to sign in again and get a new session id, but still get pages as if they are anonymous. I cannot replicate this, so deeper testing is difficult. I'm not sure if it's django failing to recognize the session somehow, or perhaps the pages are getting cached for them (confirmed it's not browser cache). The main site page is served with cache-control headers: no-cache, max-age=0, must-revalidate, and django should serve a redirect if the user is authenticated, which is not happening.
Any suggestions on why this might be happening or what to look for are appreciated.
