title: How does token authentication work with load balanced web services
body: <p>We are using token based security on some of our ArcGIS Server web services and I'm trying to gain a better understanding of how they work. We currently have to use sticky sessions because we have load balanced services for redundancy and performance.  However all the documentation I read (the below article for example) suggests that using token authentication should actually remove the need for sticky sessions.  After all the reading I have done I am still not sure why this is the case.</p>
  
  <p>If a user logs in and receives a token from one of our load balanced servers and the token is passed with every subsequent request, why should it not be necessary to ensure that the request ends up on the same server.  How would the other server be able to authenticate the token? The only way I can think of based on my readings that this could be made to work without sticky sessions is to store the token signature in a central repository available to all the load balanced servers. Then again this is not that different from just storing the token itself which is the same as storing session information.</p>
  
  <p><a href="http://code.tutsplus.com/tutorials/token-based-authentication-with-angularjs-nodejs--cms-22543" rel="noreferrer">http://code.tutsplus.com/tutorials/token-based-authentication-with-angularjs-nodejs--cms-22543</a></p>