Concept questionMedium~7 minRedis in Production / 6 of 7

Interview question

How would you handle session state when an ASP.NET Core app is scaled out to multiple instances?

Store session state safely in scaled-out ASP.NET Core

Explains session state choices for scaled-out ASP.NET Core APIs and when Redis-backed state is appropriate.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I would prefer a stateless API when possible, using authentication tokens and durable server-side data rather than relying on per-instance session memory. If the product needs server-side session state, it must be stored somewhere shared, such as Redis or a database, because requests may go to different instances after scale-out. The key point is that local memory works only until another instance, restart, or deployment handles the next request.

Full answer below

Practice focus

Stateless APIs, distributed session storage, sticky sessions, Redis-backed session, security, expiry, and deployment behavior.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Session state is a practical scale-out question. It tests whether the app can survive multiple instances, restarts, and rolling deployments.
I would prefer a stateless API when possible, using authentication tokens and durable server-side data rather than relying on per-instance session memory. If the product needs server-side session state, it must be stored somewhere shared, such as Redis or a database, because requests may go to different instances after scale-out. The key point is that local memory works only until another instance, restart, or deployment handles the next request.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would avoid sticky sessions as the main design because they hide the problem and break down during restarts, deployments, uneven load, or failover. Redis-backed session can work for temporary state, but I would keep it small, scoped, encrypted or protected where needed, and have clear expiration. Important workflow state belongs in a durable database, not only in session.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I would classify each session value: authentication context, cart, multi-step form, preferences, temporary tokens, or workflow progress. Each has different durability and security needs. I would monitor session-store latency, size, expiration behavior, and error rate. I would also test rolling deployment and scale-out with multiple instances so hidden in-memory assumptions are caught before users see random logouts or lost progress.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Keeping session data in memory after adding multiple instances.
Using sticky sessions as a permanent fix.
Putting large or durable workflow state in Redis session.
Ignoring session expiry and security protection.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

Cannot explain why scale-out breaks in-memory session.
No distinction between temporary and durable state.
No plan for restarts or rolling deployment.
Stores sensitive data casually in session.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

When is stateless better than distributed session?
What session data belongs in a database?
How would you test this before scale-out?

Continue the section

Next in Redis in Production: Pub/Sub vs Queue

Step 7 of 7

Compare Redis pub/sub and durable queues for cache invalidation

Opening drill

Concept questionMedium~7 minRedis in Production / 6 of 7

Interview question

How would you handle session state when an ASP.NET Core app is scaled out to multiple instances?

Store session state safely in scaled-out ASP.NET Core

Explains session state choices for scaled-out ASP.NET Core APIs and when Redis-backed state is appropriate.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

Stateless APIs, distributed session storage, sticky sessions, Redis-backed session, security, expiry, and deployment behavior.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
Session state is a practical scale-out question. It tests whether the app can survive multiple instances, restarts, and rolling deployments.
I would prefer a stateless API when possible, using authentication tokens and durable server-side data rather than relying on per-instance session memory. If the product needs server-side session state, it must be stored somewhere shared, such as Redis or a database, because requests may go to different instances after scale-out. The key point is that local memory works only until another instance, restart, or deployment handles the next request.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
I would avoid sticky sessions as the main design because they hide the problem and break down during restarts, deployments, uneven load, or failover. Redis-backed session can work for temporary state, but I would keep it small, scoped, encrypted or protected where needed, and have clear expiration. Important workflow state belongs in a durable database, not only in session.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I would classify each session value: authentication context, cart, multi-step form, preferences, temporary tokens, or workflow progress. Each has different durability and security needs. I would monitor session-store latency, size, expiration behavior, and error rate. I would also test rolling deployment and scale-out with multiple instances so hidden in-memory assumptions are caught before users see random logouts or lost progress.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Keeping session data in memory after adding multiple instances.
Using sticky sessions as a permanent fix.
Putting large or durable workflow state in Redis session.
Ignoring session expiry and security protection.

Red flagsCandidateRed flagsSignals that an interviewer may treat as risky.Open details

Details

Cannot explain why scale-out breaks in-memory session.
No distinction between temporary and durable state.
No plan for restarts or rolling deployment.
Stores sensitive data casually in session.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

When is stateless better than distributed session?
What session data belongs in a database?
How would you test this before scale-out?

Continue the section

Next in Redis in Production: Pub/Sub vs Queue

Step 7 of 7

Compare Redis pub/sub and durable queues for cache invalidation

How would you handle session state when an ASP.NET Core app is scaled out to multiple instances?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue the section

How would you handle session state when an ASP.NET Core app is scaled out to multiple instances?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue the section