Short answer
The app is stateful: session/cart data lives in one instance's heap, and the load balancer routed the refresh to a different instance behind the same DNS name.
Explanation
The cheap patch is sticky sessions (IP hash / cookie affinity), but that pins users to nodes and breaks rolling deploys and even rebalancing. The real fix is externalizing state to a shared store (Redis, the database) or a signed token, making every instance interchangeable so any node can serve any request.
Common mistakes
- Blaming the database before checking sticky sessions and in-memory session state.
- Not suggesting an external session store such as Redis.