session - Rails 4 authenticity_token using multiple servers -

regarding sessions in rails using cookiestore, if have 2 servers same rails applications , configured same way (identical hashes, , config), know if 1 user hits first server , starts session, if next requests hit second server application work okay. that's ok now.

but, regarding forms , authenticity_token, how deal (preventing csrf)?

suppose have cookie hash session (using cookiestore) stored using cookies in client side (browser). no session used on server side @ all.

so, if generate authenticity_token server 1 , next request (post form) hits server 2, request rejected throwing error or rails exception.

how deal this? sharing authenticity_tokens in memory or using "middleware" software, instance redis key value storage every server can verify authenticity_tokens?

thanks!

as rails version 4 see that:

"if have secret_key_base set, cookies encrypted. goes step further signed cookies in encrypted cookies cannot altered or read users. default starting in rails 4."

(documentation of cookiestore, http://api.rubyonrails.org/classes/actiondispatch/session/cookiestore.html).

so think authenticity_token set in session (cookie-side) , sent form hidden field, next request validated independently of server (server1, server2, , on). encryption authenticity_token not seen users on client side. no encryption can seen , can security problem.