Which cookie names are reserved by ALB?
The Application Load Balancer reserves cookie names starting with the prefixes 'AWSALB', 'AWSALBAPP', and 'AWSALBTG' for its own use; custom application-based cookies cannot use these names [citation:3][citation:7].
When using sticky sessions on an Application Load Balancer (ALB), the load balancer uses specific cookie names for its own stickiness mechanisms [citation:3][citation:7]:
- 1
AWSALB: Used by the ALB for duration-based stickiness. - 2
AWSALBAPP: Used by the ALB for application-based cookies. - 3
AWSALBTG: Reserved for use by the ALB for target group stickiness.
These cookie names are reserved for exclusive use by the AWS load balancer. When implementing your own application-based cookies for stickiness, you must avoid using names that start with these prefixes, as they will be overwritten or ignored by the ALB [citation:7].
Scenario Questions
0-2 years experience
- 1You need to enable sticky sessions on an ALB for a web service. Which cookie name should you avoid using in your application, and why?
- 2If your backend sets a cookie called 'AWSALB', what will happen to that cookie when the request passes through the ALB?
- 3How would you check that your code isn’t unintentionally overwriting the ALB’s stickiness cookie?
2-5 years experience
- 1During a recent deployment users started losing session affinity. You discover a new feature sets a cookie named 'AWSALBTG'. Walk me through how that could break ALB stickiness and how you would fix it.
- 2Explain the trade‑offs between using the ALB‑generated cookie versus an application‑controlled cookie, especially considering the reserved names.
- 3While debugging a 502 error you notice the ALB isn’t inserting its stickiness cookie. What naming or configuration issues would you investigate first?
5-8 years experience
- 1Design a multi‑tenant SaaS platform behind a single ALB with stickiness enabled. How do you ensure each tenant’s services don’t clash with the ALB’s reserved cookie names, and what isolation patterns would you use?
- 2At high traffic scale you want to rotate the stickiness cookie name to avoid caching issues. Is that possible with ALB, and what alternative strategies could you employ?
- 3If you need to migrate from ALB stickiness to a custom session store, how would you handle the existing reserved cookies during the transition to avoid user impact?
8+ years experience
- 1Your organization plans to consolidate several microservices behind a shared ALB while adopting a service mesh that also injects its own cookies. How would you architect a cookie‑namespace strategy to prevent collisions with ALB’s reserved names across teams?
- 2Considering a future migration from ALB to a third‑party load balancer with different reserved‑cookie semantics, what governance and migration processes would you establish now to future‑proof your applications?
- 3In a global, multi‑region deployment using ALBs in each region, how do you ensure consistent handling of the reserved cookie names for session affinity while also meeting GDPR cookie‑consent requirements?
Follow-up Questions
- What error or user‑experience symptom would you see if an app overwrites one of these reserved cookies?
- Can you set a custom cookie with a similar prefix, like AWSALB_USER, and would that be safe?
- How does the ALB decide which cookie to send when both stickiness types are enabled?