We use Redis as a record level distributed lock on top of pub/sub and a cache and a queue. We also take advantage of expiring keys to detect if users are connected or have activity. We used to use it a session store but switched to encrypted cookies. I know some have used it as a semaphore as well.
What did the semaphore usage look like? Did it use pub/sub or something else?
Also what encryption algorithm are you using on your cookies. I ask because certain algorithms produce malleable ciphertexts, which could potentially be a huge vulnerability.
