title: Session Management in microservices
body: <p>We have the following setup.</p>
  
  <ol>
  <li>STM (Stingrey Traffic Manager) does load balancing + session stickiness</li>
  <li>Weblogic 'cluster'</li>
  <li>Auth handled by a third party tool</li>
  </ol>
  
  <p>Therefore I do not have to worry about session with regards to horizontal scaling/ running multiple instances of the application. STM/ Weblogic cluster makes sure that the subsequent request come to same managed server.</p>
  
  <p>What we currently have is a monolithic application and we are trying to move to microservices. Also we do not wan't to move out of current infrastructure (i.e. STM/ Weblogic cluster/ Auth tool). What we have planned is:</p>
  
  <ol>
  <li>A Gateway WAR which routes requests to other microservices</li>
  <li>N x Microservices (WAR) for each functional sub-domain</li>
  <li>Only the API Gateway receives user requests and other microservices are not accessible from outside</li>
  </ol>
  
  <p>So my question is</p>
  
  <ol>
  <li>Should API Gateway be state-full while other microsevices are stateless?</li>
  <li>If so, how should the user session data be shared between API Gateway and microservices?</li>
  </ol>
  
  <p>Please suggest any better alternatives and resources/links as well.  Thanks.</p>