Does Ktor preserve session cookies across major version upgrades?
0 reputation · 06 Oct 2025, 16:06 UTC
Session cookie survival across a Ktor upgrade
The goal is to determine whether session state created under an earlier Ktor major release remains valid after the application is upgraded to a newer major release, without requiring users to obtain new cookies.
Ktor's default SessionProvider is cookie-based, but its serialization format and configuration can change between major releases. Available release notes mention interceptor deprecations without clarifying whether existing session cookies are rejected, ignored, or safely deserialized after an upgrade. This leaves the compatibility of legacy session state unresolved.
Assume the upgrade path moves between supported Ktor major versions and that the application continues to use the default cookie-based SessionProvider unless explicitly replaced.
Does Ktor guarantee backward compatibility of session cookie serialization across major versions? Which SessionProvider setting controls legacy cookie deserialization after an upgrade? What happens to existing session cookies when the default serialization format changes?