Aspects of the present disclosure relate to establishing a secure session between a client device and a stateful backend server or host. The system described herein uses an identity token and an authorization token to generate a globally unique identifier that is associated with the client device. The globally unique identifier is then used to create a one-to-one mapping between the client device and the backend server.