We're having several issues with users getting logged out and/or not being able to sign in to our Django application. We have a single database, multiple front end servers, and a nginx load balancer using ip_hash, and are experiencing two problems, I'm not sure if they are related.

The first is that many users will get logged out if their hits move from one frontend server to another, for instance if one is taken down for maintenance. Just using the standard Django database session storage and auth package so it seems like this shouldn't be an issue.

The second is that a few users are having problems signing in. After they have been authenticated, (and confirmed that their sessionid matches one for their user in the db), the site then responds to their requests as if they are not signed in. They can try to sign in again and get a new session id, but still get pages as if they are anonymous. I cannot replicate this, so deeper testing is difficult. I'm not sure if it's django failing to recognize the session somehow, or perhaps the pages are getting cached for them (confirmed it's not browser cache). The main site page is served with cache-control headers: no-cache, max-age=0, must-revalidate, and django should serve a redirect if the user is authenticated, which is not happening.

Any suggestions on why this might be happening or what to look for are appreciated.

| improve this question | | | | |
  • did you get any solution for your answer – aibotnet Aug 26 '16 at 11:27

It seems like this should work. Just to confirm: do you have django.contrib.sessions in your installed apps? That will set up database-backed sessions, so that it shouldn't matter which front end you hit.

The other possibility is that you're setting your cookies wrong. If someone ends up at different front end machines, do the domains reflect that? As in, are they being redirected to fe1.yourapp.com or fe2.yourapp.com, or do they always end up at www.yourapp.com?

One case where I've seen something similar is when people could hit either yourapp.com or www.yourapp.com, and cookies were being set differently -- if you went to the subdomain first, your cookie wouldn't get passed if you later hit the base domain. Our somewhat inelegant solution was to redirect everyone to the www subdomain.

| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.