title: CodeIgniter Session breaks on non-sticky-session load balanced server
body: <p>I have a tricky problem; I've had it for a month or so so I have researched extensively.</p>
  
  <p>I have a CodeIgniter site that is hosted - not by my choice, nor anything I have the power to change - by a third party, on 2 servers, load balanced by a third. The fun part is that the load balancer chooses at random the server, there are no sticky sessions.</p>
  
  <p>Now, by default CI is supposed to handle this, using either cookies or storing the session in the DB. We've got the session set to autoload, </p>
  
  <pre><code>$autoload['libraries'] = array('session', 'user_agent', 'rest_client', 'lib_log');
  </code></pre>
  
  <p>The config has this in place for session and cookies:</p>
  
  <pre><code>/*
  |--------------------------------------------------------------------------
  | Session Variables
  |--------------------------------------------------------------------------
  |
  | 'sess_cookie_name'        = the name you want for the cookie
  | 'sess_expiration'         = the number of SECONDS you want the session to     last.
  |   by default sessions last 7200 seconds (two hours).  Set to zero for no expiration.
  | 'sess_expire_on_close'    = Whether to cause the session to expire automatically
  |   when the browser window is closed
  | 'sess_encrypt_cookie'     = Whether to encrypt the cookie
  | 'sess_use_database'       = Whether to save the session data to a database
  | 'sess_table_name'         = The name of the session database table
  | 'sess_match_ip'           = Whether to match the user's IP address when reading the session data
  | 'sess_match_useragent'    = Whether to match the User Agent when reading the session data
  | 'sess_time_to_update'     = how many seconds between CI refreshing Session Information
  |
  */
  $config['sess_cookie_name']     = 'e1fdc095-98e2-4294-9584-362ba355bacf';
  
  $config['sess_expiration']      = 3600;
  $config['sess_expire_on_close']= TRUE;
  $config['sess_encrypt_cookie']  = TRUE;
  $config['sess_use_database']    = FALSE; // obviously used TRUE when trying to use DB
  $config['sess_table_name']      = 'ci_sessions';
  $config['sess_match_ip']        = FALSE;
  $config['sess_match_useragent']= TRUE;
  $config['sess_time_to_update']  = 300;
  
  /*
  |--------------------------------------------------------------------------
  | Cookie Related Variables
  |--------------------------------------------------------------------------
  |
  | 'cookie_prefix' = Set a prefix if you need to avoid collisions
  | 'cookie_domain' = Set to .your-domain.com for site-wide cookies
  | 'cookie_path'   =  Typically will be a forward slash
  | 'cookie_secure' =  Cookies will only be set if a secure HTTPS connection exists.
  |
  */
  $config['cookie_prefix']    = "";
  $config['cookie_domain']    = "";
  $config['cookie_path']  = "/";
  $config['cookie_secure']    = TRUE;
  $config['cookie_httponly']  = TRUE;
  </code></pre>
  
  <p>(I am hoping against hope that something in that config is wromg? <code>sess_cookie_name</code> too long? <code>sess_match_ip</code> should be true?)</p>
  
  <p>1) With cookies: the site works on a single node, but session disappears when the request is directed to another server. When the request is directed to the original server, session is back. This often (but not always - sometimes the user strikes it lucky and all requests go to one server) leads to infinite redirect loops (until the browser stops trying). </p>
  
  <p>Interestingly in this case the standard behaviour upon login is to move from the controller/method (<code>A/login</code>) that creates session, to a method in another controller (<code>B/index</code>), to a method in the same controller (<code>B/welcome</code>). It is always <code>B/welcome</code> that fails to recognise the session, and redirects back to <code>A/login</code>. Then the loop starts, as <code>A/login</code> recognises the session.</p>
  
  <p>2) With database: the session is not created, and apparently ( I am unable to monitor the DB ) the session is not created in the DB either. This has not been fully explored, partly because a unique ID for the session in the DB would have to be stored on the client, and the only place for that is a cookie. If using a cookie at all, why use a database?</p>
  
  <p>(also the 3rd party hosts rolled back that attempt and it's pretty hard to get them to do anything further)</p>
  
  <p>So I have a site that works 100% on my (single) server, on their servers, if the load is entirely on only one server, but fails when the load balancer is operating as expected. This is true of both the cookie and DB storage methods.</p>
  
  <p>I am at my wits end. If anyone has any possible solution, or suggestion, please let me know.</p>