# All sessions invalidated: pre-release checklist

Source: https://releasefailures.com/incidents/all-sessions-invalidated/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A change to session signing or storage logs every user out at once.
- [ ] PR-01 Compare the hash of the token secret key in the release configuration with the one in production and block the release on any difference. (test class: Configuration and environment tests)
- [ ] PR-02 Confirm that the platform does not generate a new session secret on each deploy by checking that the variable is set explicitly in production. (test class: Configuration and environment tests)
- [ ] PR-03 Confirm that every instance in the target environment points at the same session store before the rollout begins. (test class: Configuration and environment tests)
- [ ] PR-04 Log in on the current release, deploy the new release to half of the instances, and confirm the same session is accepted on both halves. (test class: End-to-end tests)
- [ ] PR-05 Send a session cookie issued by the current release through the edge worker script and the new release and confirm both read it as a valid session. (test class: End-to-end tests)
- [ ] PR-06 Halt the canary when token validation errors per minute exceed the pre-deploy rate. (test class: Canary and progressive delivery checks)
- [ ] PR-07 Hold the canary at a small share of instances until the forced logout rate stays at its pre-deploy level for a full session lifetime. (test class: Canary and progressive delivery checks)