Session Management in microservices

Question

We have the following setup.

1. STM (Stingrey Traffic Manager) does load balancing + session stickiness
2. Weblogic \'cluster\'
3. Auth handled by a t

Answer 1

1)Should API Gateway be state-full while other microservices are stateless?

Yes, As in 12 Factor App guide lines all the services should be stateless.

2)If so, how should the user session data be shared between API Gateway and microservices?

Your API should be stateless therefore do not share the session state to the microservices. The recommended approach is to set up a Redis cache to store session data.