Logged Out At Random

A login-protected app ran fine on one server. You add a second identical server behind a round-robin load balancer, and users start reporting that they get bounced to the login page every few clicks. Sessions are kept in a process-local map. What is happening?

About half of each user's requests land on the instance that has no entry for that session, so the app treats them as signed out

The load balancer's health checks close idle backend connections mid-request, so the browser silently retries the call without attaching its session cookie

The session cookie was issued for the wrong domain, so the browser stops sending it once the second server answers

The two servers' clocks have drifted apart, so whichever one runs ahead reads every session token as already expired and rejects it