3

I am configuring a test AWS architecture for a web application that I plan to migrate from a dedicated hosting service to AWS. What I have now is as follows :

  • One MySql RDS, where my application data is.
  • Two EC2 instances. This instances have the application source code (Written in PHP) and already configured to connect to the RDS.
  • One load balancer. I have set it up to autoscale between 2 and 10 instances, according to the processor usage, but I most likely adjust the policies once the application go live.

The new EC2 instances will already be launched with the code and RDS connection parameters ready via a custom image, and I am working in the Sao Paulo region.

Everything works fine except for one thing. If I access the website via the ELB DNS record, I see the site there but I cannot log in. Nothing happens when I put the user credentials. (The site is basically an admin panel so I have to log in to see their contents), but if I access through an individual instance IP or DNS record, I can log in and use the application normally. The user data (user and password) is stored in the RDS.

If anybody has experienced anything similar, I really appreciate your help. Thank you in advance!

  • 1
    Does your app rely on getting the IP address of the client from a header to create a session? If so, you may be seeing the load balancer IP rather than the client. The actual client IP can be found in the X-Forwarded-For header. – ianjs Jul 8 '14 at 7:16
  • thank you guys for your help. I'm still trying to sort it out. As @ugurarpaci said, seems to be a session or redirection issue, because if i change the number of instances to just 1, it works fine behind the load balancer. If I put 2 instances the application tries to log in and then jumps to the next balanced instance, and it asks credentials again, etc. So I guess I should find a way to tell the application 'log in this instance and then stay here, don't go somewhere else'. Any thoughts? – Andres Jul 10 '14 at 6:25
1

The usual way of maintaining a session is:

  1. Authenticate the user.
  2. Send a cookie to the browser with a unique ID for that session.
  3. Look for the session cookie on subsequent hits from that browser.

The session cookie would normally be stored and retrieved from a location that is independent of the web servers, for example a separate database server. That way it doesn't matter which web server they hit, they will get the same cookie and the same session.

The session cookie needs to be secure and unique to the client, so some apps will create a hash that includes the client IP in the calculation. If this is the case then a different IP looks like a different session.

You'll need to check your app to see if this is the case.

Alternatively, if you actually need to tie the session to a particular server (e.g. the app stores state locally on the web server) you can use ELB Sticky Sessions to tie a session to a particular web server. This should only be required if your app actually stores state locally on each web server.

1

When you try to access via ELB, do you get any access log or any kind of logging on your application ? If not, thats more likely a IP transition issue between ELB and EC2 instances. Could be application specific, like; do you need a real IP address of the client (like X-Forwarded-For header) ? Maybe, its because of the authentication logic that you use in your app.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.