We have a multi-tiered architecture running .Net on the UI, then various other tech on additional EC2 instances.
Using load balancers from Amazon's web services, we can scale up as many of those instances as required by the usage. However, we have a big problem with multiple Web UI services.
A User logged in from the 1st instance of the Web UI, cannot make calls to/from the second instance of the Web UI. The Anti-Forgery token prevents this and results in a lot of errors. It doesn't take long and the entire system starts hanging, running CPU usage to 100% and crashing.
I've tried/found:
- Removing all Anti-Forgery attributes. It did not work, plus it leaves us open to attacks.
- Sharing the Anti-Forgery token and session information across to the other instance. Not sure how to do this cleanly, and it violates our security settings.
- Isolating User's to only a single instance... but I cannot find a way to implement this. Only seen a few mentions of it.
I've googled quite a bit and haven't had any luck finding a solid solution. This is an emergency, so any ideas would be greatly appreciated!
Thank you in advance.
Update:
Here are some resources we are finding:
https://aws.amazon.com/getting-started/hands-on/setting-up-a-redis-cluster-with-amazon-elasticache/
Kubernetes + Redis: The antiforgery token could not be decrypted
Good video tutorial for .NetCore: https://www.youtube.com/watch?v=jwek4w6als4