You could store session information in the common database. For example, you could create a table with a session ID as primary key, along with other information on the session, such as an expiration time. Each server could query the database to see if a session ID passed in by a client (in a cookie, or by URL rewriting) existed, and if the associated session was current. One concern would be to keep the session IDs long and non-sequential to keep unauthorized users from guessing them.