JA EN
shiichan

Session affinity and hash steering arrive in Cloudflare's private load balancers

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#infrastructure#security

Hi, it's Shiichan! The private load balancer that fronts your internal apps now has the much-wanted ability to keep users on the same server.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to Cloudflare's Changelog, private load balancers can now keep each user on the same endpoint.

This helps with applications that keep session state on a single server.

Why it matters

If an app keeps login state in a server's memory, being sent to a different server on each request makes the session look like it expired.

To avoid that, you need a way to keep sending the same user to the same place.

What changes

There are two options:

  • Hash endpoint steering: in the dashboard, set a pool's Endpoint steering to Hash. Each user is mapped to an endpoint within the pool
  • Session affinity: with the API, set session_affinity to ip_cookie on the load balancer. Each user stays on the same endpoint while it remains healthy and your pools do not change

Dive Deep

How users are identified depends on the traffic:

  • Traffic from the Cloudflare One Client: Cloudflare identifies the user by their device, so a user stays on the same endpoint even if their IP address changes
  • Other traffic, such as from a Cloudflare WAN site: Cloudflare uses the source IP address

It works for endpoints reached through:

  • Cloudflare Tunnel
  • Cloudflare Mesh
  • Cloudflare WAN

An endpoint here is an IP address plus a virtual network. Also note that affinity pins the endpoint, not the cloudflared or Mesh replica that carries the traffic. See the Session affinity and Load balance private network traffic docs for details.

Wrap-up

  • Private load balancers can keep users on the same endpoint
  • Choose hash steering in the dashboard or session_affinity set to ip_cookie in the API
  • The Cloudflare One Client is identified by device, so pinning survives IP changes
  • The endpoint is pinned, not the cloudflared or Mesh replica

This is for infrastructure folks exposing stateful internal apps through Cloudflare One!

Related posts