---
title: In-memory sessions
description: In-memory sessions reside in AM's memory. AM sends clients a reference to the session, but the reference does not contain any of the session state information.
component: pingam
version: 7.3
page_id: pingam:sessions-guide:sec-in-memory-sessions
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-sessions/sec-in-memory-sessions.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["Sessions", "Cookie", "Storage", "Configuration", "Load Balancer"]
---

# In-memory sessions

In-memory sessions reside in AM's memory. AM sends clients a reference to the session, but the reference does not contain any of the session state information.

* **In-memory authentication sessions**

  In-memory authentication sessions are the *only configuration supported for authentication chains*. They are also configured by default for authentication trees after an upgrade.

  During authentication, the authentication session reference is returned to the client after a call to the `authenticate` endpoint and stored in the `authId` object of the JSON response.

  AM maintains the user's authentication session in its memory. After the authentication flow has completed, AM performs the following tasks:

  * If the realm to which the user has authenticated is configured for server-side sessions, AM stores the user's session in the CTS token store and deletes the authentication session from memory.

  * If the realm to which the user has authenticated is configured for client-side sessions, AM stores the user's session in a cookie on the user's browser and deletes the authentication session from memory.

  Authentication session allowlisting is an optional feature that maintains a list of in-progress authentication sessions and their progress in the authentication flow to protect against replay attacks. For more information, see [Authentication session allowlisting](../security-guide/auth-session-whitelist.html).

  |   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
  | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  |   | Deployments where AM stores authentication sessions in memory require sticky load balancing to route all requests pertaining to a particular authentication flow to the same AM server. If a request reaches a different AM server, the authentication flow will start anew\.Authentication chains only support storing authentication sessions in memory. ForgeRock recommends switching to authentication trees with server-side or client-side authentication sessions.For information about configuring AM with sticky load balancing, see [Load balancing](../setup-guide/configure-lb.html). |

* **In-memory sessions**

  AM does not support in-memory sessions for authenticated users.

Related information: [Choose where to store sessions](session-state-use-cases.html)