JSESSION synchronization/collision between tomcat instances

[Ramon Pires da Silva]

Currently I am running 6 tomcat instances, each one in a ec2 instance on aws, using the elasticache service, with the following session manager configuration :

<Manager className="de.javakaffee.web.msm.MemcachedBackupSessionManager"

    memcachedNodes="xxxxxxxxx"

    sticky="false"

    sessionBackupAsync="true"

    backupThreadCount="3"

    lockingMode="auto"

    memcachedProtocol="binary"

    sessionBackupTimeout="10000"

    operationTimeout="10000"

   />

A few days ago I had a problem that has never happened before: an user accessed another user account before the login process in the application. I suppose that may be happened because of a synchronization/collision with JSESSIONID between the instances. I know that a JSESSIONID can't be recreated inside the same tomcat/jvm, but different tomcat instances can create, eventually, the same JSESSIONID. Any help will be appreciated.