I'm evaluating session storage for a Tomcat deployment spread across three availability zones, where requests may reach different application instances. Each HTTP session is essentially a 40–100 KB key-value map. Would it be better to store sessions in an external Redis-compatible service and update the session's last-access time on every request, or use Infinispan to replicate the sessions across the JVMs? I'm especially interested in operational complexity, scalability, and reliability in a multi-AZ environment.
5 Answers
Infinispan is a reasonable option when you already operate a JVM-based clustered platform and need its specific caching features. However, clustered session replication across three availability zones can be more sensitive to network latency, node membership changes, and split-brain or partition handling. For a standalone Tomcat session store, Redis or Valkey is usually easier for an operations team to understand, monitor, back up, and replace.
The expected user count and request rate matter more than the product name. Redis can handle this use case well, but updating a 40–100 KB session on every request may create substantial network and write traffic. Keep sessions as small as possible, avoid storing data that can be fetched elsewhere, and consider whether every request really needs to rewrite the entire session. Also verify the session library’s serialization, failover, timeout, and consistency behavior.
Other distributed caches, such as Hazelcast, are possible, but switching technologies does not remove the underlying trade-offs. The important questions are session size, write frequency, eviction and expiration behavior, cross-zone latency, failover guarantees, and whether losing sessions during a cache failure is acceptable. If sessions are critical, test restoration and failure scenarios rather than relying only on normal performance tests.
Redis is commonly used for this pattern and has mature tooling, client libraries, monitoring, and managed-service options. It has also worked well for large Tomcat deployments running across many container instances. A managed Redis-compatible service such as Valkey can reduce the operational burden considerably. Just make sure the service is configured for multi-AZ availability and that session expiration is handled with TTLs.
There isn’t a universally better choice, but the main distinction is that Redis is an external data store while Infinispan is primarily an in-memory data grid unless you configure a cache store. For Tomcat sessions, an external Redis or Valkey service is often simpler to operate and makes session data available independently of the application JVMs. Infinispan can work, but cross-zone replication and cluster management add operational complexity.
That makes sense. The sessions would usually be around 40–100 KB, so I’m also concerned about the cost of replicating that amount of data on every request.