Scenario 7: Users complain they're randomly logged out when your app is deployed across three load-balanced server instances using traditional session-based authentication. What's happening, and how do you fix it?

Without sticky sessions or a shared session store, a user's session (held in one instance's memory) isn't visible to a different instance the load balancer might route them to on a subsequent request, causing an apparent random logout. Fix with either load-balancer sticky sessions, or better, externalize sessions using Spring Session backed by a shared store like Redis, so any instance can serve any authenticated request.