How would you handle sessions in a load-balanced, multi-instance deployment using stateful (session-cookie) authentication?

Either configure sticky sessions at the load balancer (always routing a given client to the same backend instance) or externalize session storage using something like Spring Session backed by Redis, so any instance can serve any request by reading the shared session store — the latter is generally preferred for resilience, since sticky sessions break if that one instance goes down.