We need distributed session. Spoiler: We DON'T roll it ourselves.

In-memory sessions stop working as soon as there is more than one server. Most production environments have more than one server so the session issue needs to be dealt with.

There are two options for sessions in a web farm. First, a load balancer can be used to lock each user on a specific box. This lets us continue to use in-memory sessions. The second is switching from in-memory to distributed session storage.

We will use a distributed session using Redis because we have existing Redis infrastructure and we don't want a complex load balancer added to the mix.

Read more at requestmetrics.com:
https://requestmetrics.com/making-of/episode-16-using-redis-for-distributed-user-sessions-in-asp-net-core