---
title: In-memory sessions
description: In-memory sessions reside in AM's memory. AM sends clients a reference to the session, but the reference does not contain any of the session state information.
component: pingam
version: 7.4
page_id: pingam:am-sessions:sec-in-memory-sessions
canonical_url: https://docs.pingidentity.com/pingam/8.1/am-sessions/sec-in-memory-sessions.html
llms_txt: https://docs.pingidentity.com/pingam/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["Sessions", "Cookie", "Storage", "Configuration", "Load Balancer"]
page_aliases: ["sessions-guide:sec-in-memory-sessions.adoc"]
superseded_by: https://docs.pingidentity.com/pingam/8.1/am-sessions/sec-in-memory-sessions.html
section_ids:
  advantages_of_in_memory_sessions: Advantages of in-memory sessions
  in_memory_authentication_sessions: In-memory authentication sessions
  in_memory_sessions: In-memory sessions
---

# In-memory sessions

In-memory sessions reside in AM's memory. AM sends clients a reference to the session, but the reference does not contain any of the session state information.

## Advantages of in-memory sessions

* Faster performance with equivalent host

  AM servers configured for in-memory authentication sessions can validate more sessions per second per host than those configured for client-side or server-side authentication sessions.

* Session information is not in browser cookies

  Authentication session information resides in AM's memory and it is not accessible to users. With client-side sessions, authentication session information is held in browser cookies.

## In-memory authentication sessions

In-memory authentication sessions are the *only configuration supported for authentication chains*. They are also configured by default for authentication trees after an upgrade.

During authentication, the authentication session reference is returned to the client after a call to the `authenticate` endpoint and stored in the `authId` object of the JSON response.

AM maintains the user's authentication session in its memory. After the authentication flow has completed, AM performs the following tasks:

* If the realm to which the user has authenticated is configured for server-side sessions, AM stores the user's session in the CTS token store and deletes the authentication session from memory.

* If the realm to which the user has authenticated is configured for client-side sessions, AM stores the user's session in a cookie on the user's browser and deletes the authentication session from memory.

Authentication session allowlisting is an optional feature that maintains a list of in-progress authentication sessions and their progress in the authentication flow to protect against replay attacks. For more information, refer to [Authentication session allowlisting](../security/auth-session-whitelist.html).

|   |                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | Deployments where AM stores authentication sessions in memory require sticky load balancing to route all requests pertaining to a particular authentication flow to the same AM server. If a request reaches a different AM server, the authentication flow will start anew\.Authentication chains only support storing authentication sessions in memory. ForgeRock recommends switching to authentication trees with server-side or client-side authentication sessions.For information about configuring AM with sticky load balancing, refer to [Load balancing](../setup/configure-lb.html). |

## In-memory sessions

*AM does not support in-memory sessions for authenticated users*.