Clarify session on file system or database

Author: rayluo

README.md

@@ -37,13 +37,12 @@ Here we will describe how to deploy it to
 * Follow the ["Quickstart: Deploy a Python (Django or Flask) web app to Azure App Service"](https://learn.microsoft.com/en-us/azure/app-service/quickstart-python),
   but replace its sample app (which does not do user sign-in) with this web app.
 
-* In particular, if you choose to ["deploy using Local Git" in "step 3 - Deploy your application code to Azure"](https://learn.microsoft.com/en-us/azure/app-service/quickstart-python?tabs=flask%2Cwindows%2Cazure-cli%2Clocal-git-deploy%2Cdeploy-instructions-azportal%2Cterminal-bash%2Cdeploy-instructions-zip-azcli#3---deploy-your-application-code-to-azure),
-  an [application-scope credential](https://learn.microsoft.com/en-us/azure/app-service/deploy-configure-credentials?tabs=portal#appscope)
-  will be automatically created with the shape as `your_app_name\$your_app_name`.
-  But your actual git username is only the `$your_app_name` part.
-
 * [Configure your app's settings](https://learn.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal#configure-app-settings) to define [these environment variables](https://github.com/Azure-Samples/ms-identity-python-webapp/blob/main/.env.sample).
 
+* If your `app_config.py` contains `SESSION_TYPE = "filesystem"`,
+  you shall turn on "session affinity" (a.k.a. "ARR affinity") in your
+  [App Service Web App's Configuration](https://learn.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal#configure-general-settings)
+
 
 ## Contributing
 

app_config.py

@@ -42,5 +42,11 @@
 
 # Tells the Flask-session extension to store sessions in the filesystem
 SESSION_TYPE = "filesystem"
-# Using the file system will not work in most production systems,
-# it's better to use a database-backed session store instead.
+# In production, your setup may use multiple web servers behind a load balancer,
+# and the subsequent requests may not be routed to the same web server.
+# In that case, you may either use a centralized database-backed session store,
+# or configure your load balancer to route subsequent requests to the same web server
+# by using sticky sessions also known as affinity cookie.
+# [1] https://www.imperva.com/learn/availability/sticky-session-persistence-and-cookies/
+# [2] https://azure.github.io/AppService/2016/05/16/Disable-Session-affinity-cookie-(ARR-cookie)-for-Azure-web-apps.html
+# [3] https://learn.microsoft.com/en-us/azure/app-service/configure-common?tabs=portal#configure-general-settings