Stateful vs Stateless

<?php

declare(strict_types=1);

/**
 * Stateless HTTP handler: session lives in Redis, any node can serve any user.
 *
 * Trade-offs:
 * - Pros: horizontal scale, no sticky sessions, rolling deploy safe.
 * - Cons: every request = Redis round trip (~1ms); Redis must be HA.
 */
final class SessionMiddleware
{
    public function __construct(
        private readonly \Redis $redis,
        private readonly int $ttl = 3600,
    ) {}

    public function __invoke(Request $req, callable $next): Response
    {
        $sid = $req->cookies->get('sid') ?? $this->newSid();

        $data = $this->redis->get("sess:$sid");
        $session = $data ? unserialize($data) : [];

        $req->attributes->set('session', $session);
        $response = $next($req);

        // Save any mutations back to Redis.
        $this->redis->setex(
            "sess:$sid",
            $this->ttl,
            serialize($req->attributes->get('session'))
        );

        $response->headers->setCookie(Cookie::create('sid', $sid, time() + $this->ttl));
        return $response;
    }

    private function newSid(): string
    {
        return bin2hex(random_bytes(16));
    }
}

package chat

import "sync"

// Stateful component: in-memory hub of WebSocket connections.
// Each node holds a subset of users (sharded by userID).
//
// Trade-offs:
//   + Sub-millisecond local fanout.
//   - Cannot horizontally scale blindly: router must know which
//     node holds which user (consistent hashing + service discovery).
//   - Lost connections on node restart; client must reconnect.
type Hub struct {
	mu    sync.RWMutex
	conns map[string]*Conn // userID -> connection
}

func (h *Hub) Register(userID string, c *Conn) {
	h.mu.Lock()
	h.conns[userID] = c
	h.mu.Unlock()
}

func (h *Hub) Send(userID string, msg []byte) bool {
	h.mu.RLock()
	c, ok := h.conns[userID]
	h.mu.RUnlock()
	if !ok {
		return false // Not on this node — router must try another.
	}
	return c.Write(msg) == nil
}

using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.Net.WebSockets;
using System.Security.Cryptography;
using System.Text.Json;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Http;
using StackExchange.Redis;

// ---- Stateless: session lives in Redis, any node can serve any user ----
//
// Trade-offs:
//   + Horizontal scale, no sticky sessions, rolling deploys are safe.
//   - Every request costs a Redis round trip (~1ms); Redis must be HA.
public sealed class SessionMiddleware(RequestDelegate next, IDatabase redis)
{
    private static readonly TimeSpan Ttl = TimeSpan.FromHours(1);

    public async Task InvokeAsync(HttpContext context)
    {
        var sid = context.Request.Cookies["sid"] ?? NewSid();
        var key = $"sess:{sid}";

        var raw = await redis.StringGetAsync(key);
        var session = raw.HasValue
            ? JsonSerializer.Deserialize<Dictionary<string, string>>(raw!) ?? []
            : [];

        context.Items["session"] = session;
        await next(context);

        // Save any mutations back to Redis.
        await redis.StringSetAsync(key, JsonSerializer.Serialize(session), Ttl);

        context.Response.Cookies.Append("sid", sid, new CookieOptions
        {
            HttpOnly = true,
            Secure = true,
            Expires = DateTimeOffset.UtcNow.Add(Ttl),
        });
    }

    private static string NewSid() => Convert.ToHexString(RandomNumberGenerator.GetBytes(16));
}

// ---- Stateful: in-memory hub of WebSocket connections ----
// Each node holds a subset of users (sharded by user id).
//
// Trade-offs:
//   + Sub-millisecond local fan-out.
//   - Cannot scale blindly: the router must know which node holds which user
//     (consistent hashing + service discovery).
//   - Connections are lost on node restart; the client must reconnect.
public sealed class Hub
{
    // ConcurrentDictionary replaces the explicit RWMutex of the Go version.
    private readonly ConcurrentDictionary<string, WebSocket> _conns = new();

    public void Register(string userId, WebSocket socket) => _conns[userId] = socket;

    public void Unregister(string userId) => _conns.TryRemove(userId, out _);

    public async Task<bool> SendAsync(string userId, ReadOnlyMemory<byte> message, CancellationToken ct)
    {
        if (!_conns.TryGetValue(userId, out var socket) || socket.State != WebSocketState.Open)
        {
            return false; // Not on this node — the router must try another.
        }

        await socket.SendAsync(message, WebSocketMessageType.Text, endOfMessage: true, ct);
        return true;
    }
}

from __future__ import annotations

import json
import secrets

import redis.asyncio as redis
from fastapi import Request, Response, WebSocket

SESSION_TTL = 3600

# ---- Stateless: session lives in Redis, any node can serve any user ----
#
# Trade-offs:
#   + Horizontal scale, no sticky sessions, rolling deploys are safe.
#   - Every request costs a Redis round trip (~1ms); Redis must be HA.
class SessionMiddleware:
    def __init__(self, client: redis.Redis, ttl: int = SESSION_TTL) -> None:
        self._redis = client
        self._ttl = ttl

    async def __call__(self, request: Request, call_next) -> Response:
        sid = request.cookies.get("sid") or secrets.token_hex(16)
        key = f"sess:{sid}"

        raw = await self._redis.get(key)
        session: dict[str, str] = json.loads(raw) if raw else {}

        request.state.session = session
        response = await call_next(request)

        # Save any mutations back to Redis
        await self._redis.setex(key, self._ttl, json.dumps(request.state.session))

        response.set_cookie("sid", sid, max_age=self._ttl, httponly=True, secure=True)
        return response

# ---- Stateful: in-memory hub of WebSocket connections ----
# Each node holds a subset of users (sharded by user id).
#
# Trade-offs:
#   + Sub-millisecond local fan-out.
#   - Cannot scale blindly: the router must know which node holds which user
#     (consistent hashing + service discovery).
#   - Connections are lost on process restart; the client must reconnect.
class Hub:
    def __init__(self) -> None:
        # asyncio is single-threaded per loop, so a plain dict needs no lock
        self._conns: dict[str, WebSocket] = {}

    def register(self, user_id: str, socket: WebSocket) -> None:
        self._conns[user_id] = socket

    def unregister(self, user_id: str) -> None:
        self._conns.pop(user_id, None)

    async def send(self, user_id: str, message: str) -> bool:
        socket = self._conns.get(user_id)
        if socket is None:
            return False  # Not on this node — the router must try another

        await socket.send_text(message)
        return True