All sessions invalidated: pre-release and first 30 minutes checklists

A change to session signing or storage logs every user out at once.

The pre-release checklist maps each item to a test class from the incident page. The first-30-minutes checklist covers detection, containment, the rollback decision and customer communication.

7 pre-release items · 6 first-30-minutes items · verified 2026-10-21

Pre-release checklist

PR-01Compare the hash of the token secret key in the release configuration with the one in production and block the release on any difference. config
PR-02Confirm that the platform does not generate a new session secret on each deploy by checking that the variable is set explicitly in production. config
PR-03Confirm that every instance in the target environment points at the same session store before the rollout begins. config
PR-04Log in on the current release, deploy the new release to half of the instances, and confirm the same session is accepted on both halves. e2e
PR-05Send a session cookie issued by the current release through the edge worker script and the new release and confirm both read it as a valid session. e2e
PR-06Halt the canary when token validation errors per minute exceed the pre-deploy rate. canary
PR-07Hold the canary at a small share of instances until the forced logout rate stays at its pre-deploy level for a full session lifetime. canary

First 30 minutes

FM-01Check the token validation and Session Expired error rates since the deploy started, including logs that are normally suppressed.
FM-02Compare the session secret and session store setting on instances running the old and new release.
FM-03Decide between finishing the rollout and rolling back by checking which direction puts every instance on one session format and one store.
FM-04Add fallback validation with the previous secret if the secret changed, so existing tokens validate again.
FM-05Disable or redeploy any edge script that parses session cookies if it cannot read the new format.
FM-06Tell users that they must log in again, and give app users the exact steps, such as clearing app data, if a stale token blocks login.

Download the checklist

Pre-release checklist (Markdown)1.5 KB · v1.0.0
First 30 minutes checklist (Markdown)1.0 KB · v1.0.0

Only in this checklist

PR-06 is the only item among 6 published checklists in this group that relies on canary and progressive delivery checks: Halt the canary when token validation errors per minute exceed the pre-deploy rate.

Questions

What should be checked before a release to prevent All sessions invalidated?

7 pre-release items, PR-01 to PR-07. PR-01: Compare the hash of the token secret key in the release configuration with the one in production and block the release on any difference.

Is there a rollback plan for All sessions invalidated?

The first-30-minutes checklist has 6 items. FM-01: Check the token validation and Session Expired error rates since the deploy started, including logs that are normally suppressed.

What should a team do in the first 30 minutes after All sessions invalidated is detected?

The first-30-minutes checklist has 6 items. FM-01: Check the token validation and Session Expired error rates since the deploy started, including logs that are normally suppressed.

Which configuration checks apply to All sessions invalidated?

PR-01: Compare the hash of the token secret key in the release configuration with the one in production and block the release on any difference. PR-02: Confirm that the platform does not generate a new session secret on each deploy by checking that the variable is set explicitly in production. PR-03: Confirm that every instance in the target environment points at the same session store before the rollout begins.

Is a All sessions invalidated checklist still needed if deployment is automated?

Yes. Automation runs the steps; the checklist names what the tests must cover: configuration and environment tests, end-to-end tests and canary and progressive delivery checks.

Which pipeline stages does the All sessions invalidated checklist cover?

The pre-release items map to the pre-deploy and post-deploy stages.