title: Can two instances of tomcat running same application create same sessionId for two different users?
body: <p>I am working on creating shared session implementation for an application. In doing so I wanted to first understand the way tomcat (spring boot with embedded tomcat) creates Sessions for authenticated user.</p>
  
  <p>I found <code>org.apache.catalina.util.StandardSessionIdGenerator#generateSessionId</code> method creates sessionid, It's uses secure random number generator and <code>jvmRoute</code> (which I have never set any where in <code>tomcat)</code>.</p>
  
  <p>For the sake of this discussion if we consider <code>jvmRoute=""</code>, then this means If I run two tomcat instances behind a lb there will be collision of sessionid, but by default session affinity is enabled we will not have any issues. </p>
  
  <p>But as soon as we remove session affinity we will face issues where two users can have same sessionid. </p>
  
  <p>Did anyone face this issue and have resolved it? </p>