I think the answer to # 2 is the answer to # 1. Basically, you need to emulate how the browser handles cookies in your code. A โsession cookieโ is just a cookie, that is, the value passed as an HTTP header along with the request and response โ what makes it a session cookie is that its expiration date is set to the past, which tells the browser to delete it when the browser instance closes.
Cookies are quite simple - a mechanism to circumvent the fact that HTTP has no state (no memory). If you pass the HTTP header Set-cookie: <value> in the response, the client must remember the value and pass it back to the Cookie: <value> header in subsequent requests. (There are a few more cookies related to domains and expiration, etc., but that's not so much.)
So, if your client (Roku) has some kind of stability mechanism, you just need to save any new cookie, and then before setting a new random one, check the header, and if the cookie has been saved, just send it back as it is . You will probably need to implement some kind of task that periodically clears expired cookies, etc.
Do not be afraid of cookies. This is just a title (with magical abilities conveyed by the browser).
Tom harrison jr
source share