Session affinity
When you enable session affinity, your load balancer directs all requests from a particular end user to a specific endpoint. This continuity preserves information about the user session — such as items in their shopping cart — that might otherwise be lost if requests were spread out among multiple servers.
Session affinity can also help reduce network requests, leading to savings for customers with usage-based billing.
Session affinity automatically directs requests from the same client to the same endpoint:
- When a client makes its first request, Cloudflare sets a
__cflbcookie on the client (to track the associated endpoint). - Subsequent requests by the same client are forwarded to that endpoint for the duration of the cookie and as long as the endpoint remains healthy.
- If the cookie expires or the endpoint becomes unhealthy, Cloudflare sets a new cookie tracking the new failover endpoint.
flowchart LR
accTitle: Session affinity process
accDescr: Session affinity directs requests from the same client to the same server.
A[Client] --Request--> B{<code>__cflb</code> cookie set?}
B -->|Yes| C[Route to previous endpoint]
C --> O2
B ---->|No| E[Follow normal routing]
E --> O2
E --Set <code>__cflb</code> cookie--> A
subgraph P1 [Pool 1]
O1[Endpoint 1]
O2[Endpoint 2]
end
All cookie-based sessions default to 23 hours unless you set a custom session Time to live (TTL).
The session cookie is secure when Always Use HTTPS is enabled. Additionally, HttpOnly is always enabled for the cookie to prevent cross-site scripting attacks.