I have a FastAPI server that creates a user session with the following code:

@app.post("/session")
async def create_session(req: reqs.LoginRequest, response: Response):

    session = uuid.uuid4()
    data = SessionData(session_id=str(session), username=req.username, world_id="1")

    await backend.create(session, data)
    cookie.attach_to_response(response, session)

I deploy the server to AWS ECS. There are two tasks running, serving the same image.
When I try to get the session, it alternates between a correct response, and a 403 forbidden invalid session response.

I might be wrong, but it seems the cookie is being set such that it only works with the ECS task/instance that set it.

What’s the correct way to go around this?