title: HazelCast session sharing between Zuul API gateway and Resource servers
body: <h2><strong>SCENERIO</strong></h2>
  
  <p>I have Zuul Server as API gateway, Identity Server with Oauth2, ResourceServer1 and ResourceServer2 in <a href="https://github.com/dhilish/zuulandhazelcastwithoauth2" rel="nofollow noreferrer">sample</a></p>
  
  <p>ZuulServer, ResourceServer1 and ResourceServer2 have a distributed session with Hazelcast.</p>
  
  <p>Following are the steps that i had performed - </p>
  
  <ol>
  <li><p>Http page reqest that comes to zuul server will be redirected to login page at identity server. Autheticate user with oauth2. (A jsessionid is returned with the path "/")</p></li>
  <li><p>On receipt of auth token at zuul gateway, retained the auth token in distributed session using Hazelcast.</p></li>
  <li><p>On authentication success handler of Zuul Gateway, page is redirected to home page at ResourceServer1</p></li>
  <li><p>Web page call to resourceServer1 got routed through zuul api gateway and here at gateway, the auth token was appended</p></li>
  <li><p>Inside home page controller I wrote two functionalities, before showing the home page</p></li>
  <li><p>Functionality 1 - Set a value to the distributed hazelcast session with the key "TEST_SESSION"</p></li>
  <li><p>Functionality 2 - Made RestTemplate calls to ResourceServer2 (here I appended the cookie)</p></li>
  <li><p>RestTemplate calls to ResourceServer2 were routed through Zuul API Gateway and here at gateway, the auth token was appended</p></li>
  <li><p>Control reached the ResourceServer2 rest api controller and checked the session values. Value kept in step2 was available, but step6 value was not available.</p></li>
  <li><p>Soon afterwards, the homepage was displayed in browser (A new session was returned with ResourceServer1 context path)</p></li>
  <li><p>From web page, made rest api call to ResourceServer1 through Zuul API Gateway and here the auth token was appended.</p></li>
  <li><p>Control reached ResourceServer1 controller and returned the expected value.</p></li>
  <li><p>Found that for every api call to ResourceServer1 from web browser, a new session was created for ResourceServer1.</p></li>
  </ol>
  
  <h2><strong>PROBLEM</strong></h2>
  
  <p>I have been stuck with the following problems for the past few weeks. Please help me in this regard:- </p>
  
  <ol>
  <li><p>I want to have ResourceServer2 having access to session information created by ResourceServer1. But I could not get session information on ResourceServer2, it is always returning null. I had checked Hazelcast server using Hazelcast Mancenter and found that session is distributed.</p></li>
  <li><p>How do I restrict the creation of new sessions while making an api call to resource server? This is noticed in step 9, 10 and 12. Please note that here I want to get the value of session created in step 2 and 6 using HttpServletReqest.getSession(), and which creates a new session. If I remove the code to get the value in session,  the new session will not be created. </p></li>
  </ol>
  
  <p>Thanks in advance</p>