title: Avoid session replication in Spring rest application using Cookies
body: <p>I am working on <code>Spring 4 mvc</code> application with <code>mysql</code> database, <code>tomcat</code> server.
  Basically, I am creating a Spring rest which will be used by <code>Angular JS</code>.</p>
  
  <p><strong>Note:</strong> I am not using <code>Spring security</code>   </p>
  
  <p>In order to avoid session replication in case of <code>clustered environment</code>, I am using <code>cookie</code> approach.On login, I am generating <code>one unique session id</code> (<code>using java UUID</code>) and use it to create a <code>cookie</code> and then set the cookie in the response.Also, storing that session id in database along with any user data.  </p>
  
  <p>In order to authenticate every rest API, I have written a <code>Spring interceptor</code> which will intercept every rest API call which in turn check if there is a cookie in the request.If it is present, I am fetching session id value and using it, making a database call to check if it is valid or not. On logout, I am deleting the cookie.</p>
  
  <p>Base on what i am doing as explained above, I have few questions:</p>
  
  <pre><code>1) Is my approach correct? or do you see any flaw in it.  
  2) Let me know if there is any other better method to achieve the same i.e. to avoid session replication.  
  3) Since, I am not using any HTTP session, how do I achieve something like session-timeout or do i even need it?
  </code></pre>