# All sessions invalidated: first 30 minutes checklist

Source: https://releasefailures.com/incidents/all-sessions-invalidated/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A change to session signing or storage logs every user out at once.
- [ ] FM-01 Check the token validation and Session Expired error rates since the deploy started, including logs that are normally suppressed.
- [ ] FM-02 Compare the session secret and session store setting on instances running the old and new release.
- [ ] FM-03 Decide between finishing the rollout and rolling back by checking which direction puts every instance on one session format and one store.
- [ ] FM-04 Add fallback validation with the previous secret if the secret changed, so existing tokens validate again.
- [ ] FM-05 Disable or redeploy any edge script that parses session cookies if it cannot read the new format.
- [ ] FM-06 Tell users that they must log in again, and give app users the exact steps, such as clearing app data, if a stale token blocks login.