DDevelopment & Design

HAProxy load balancing with sticky sessions based on request body

Integrating systems you have no influence on needs a lot of workarounds. Recently we could not scale Python service consuming SOAP messages with a new hardware. It just didn’t benefit from more processing cores. On the other hand (and this happens often with older software) setting up several instances gave almost linear scalability. Only thing left – configure a loadbalancer and we are done.

Easier said than done. We had to make sure messages are loadbalanced but also that all messages related to given customer USSD conversation always hit the same backend service. So, we had to use application layer information to configure sticky sessions. This is not straightforward in HAProxy when you have to look into http payload and parse some specific information. We used HAProxy 1.6 and simple LUA script to do just that:

core.Alert("LUA script parsing SOAP element loaded");

function parseElement(txn, salt)

    local payload = txn.req:dup()

    -- parses integer value from element named "element"
    local value = string.match(string.match(payload, "element>%d+<"), "%d+")
    core.Info("value: " .. value)
    return value
end

-- register HAProxy "fetch"
core.register_fetches("parseElement", parseElement)

Put this script into a file and it can be loaded in HAProxy configuration using lua-load directive.

Script registers new HAProxy fetch which can be used to configure session stickiness.

balance roundrobin
stick-table type string size 30k expire 30m
stick on "lua.parseElement" table nodes

You have to also make sure all payload is loaded before you start parsing it. This can be achieved with option http-buffer-request configuration directive.

— Previous article

Formatting Java Time with Spring Boot using JSON

Next article —

Sputnik lands on GitHub!

You May Also Like
DDevelopment & Design

Spring Security by example: securing methods

This is a part of a simple Spring Security tutorial:

1. Set up and form authentication
2. User in the backend (getting logged user, authentication, testing)
3. Securing web resources
4. Securing methods
5. OpenID (login via gmail)
6. OAuth2 (login via Facebook)
7. Writing on Facebook wall with Spring Social

Securing web resources is all nice and cool, but in a well designed application it's more natural to secure methods (for example on backend facade or even domain objects). While we may get away with role-based authorization in many intranet business applications, nobody will ever handle assigning roles to users in a public, free to use Internet service. We need authorization based on rules described in our domain.

For example: there is a service AlterStory, that allows cooperative writing of stories, where one user is a director (like a movie director), deciding which chapter proposed by other authors should make it to the final story.

The method for accepting chapters, looks like this:

Read more »