title: Client side sessions
body: <p>I want the clients of several related web apps to hold their own authentication state. This improves scalability, because no session replication between cluster nodes is needed. And it makes integration of different server technologies like Java Servlets and PHP easier. </p>
  
  <p>My plan is as follows:</p>
  
  <ol>
  <li>Set a signed and encrypted cookie with the user name and session expiration time after client authentication.</li>
  <li>When the client sends a request, the server decrypts and validates the cookie and grants or denies access depending on the cookie values.</li>
  <li>The session expiration will be updated through resetting the cookie.</li>
  </ol>
  
  <p>All servers that want to use the session have only to know the cookie mechanism and the decryption key. See also: <a href="http://java.sun.com/blueprints/qanda/client_tier/session_state.html" rel="noreferrer">Session state in the client tier</a></p>
  
  <p>Is this approach ok? Would it be possible to integrate it into a servlet container / application Server so that it is transparent to the applications? A servlet should be able to use HttpServletRequest#getRemoteUser() for example. Is this possible? Or would I need something above the container level like Spring Security? Are there any existing libraries for client side session management?</p>