Does Ktor preserve session cookies across major version upgrades?

Direct Answer

No. Ktor does not guarantee backward compatibility of session cookie serialization across major versions. If the default SessionSerializer format changes during an upgrade, existing cookies are rejected during deserialization and the user receives a new, empty session.

Likely Explanation vs. Confirmed Behavior

The likely explanation is that the default cookie provider relies on a SessionSerializer—typically backed by Kotlinx.Serialization—whose wire format can change when Ktor upgrades its internal encoding or the serialization library version. Release notes for major upgrades often highlight API redesigns without explicitly documenting cookie-format stability, so the absence of a compatibility statement should be treated as a breaking change rather than a guarantee of continuity.

Configuration Hook

No built-in setting automatically enables legacy cookie deserialization. The extension point is the serializer property in the session configuration DSL. To preserve sessions across an upgrade, supply a custom SessionSerializer that attempts the old format first, falls back to the new format, or embeds a version marker in the cookie payload and branches on it.

Scoped Steps

1. Identify the exact artifact (ktor-server-sessions or the newer multiplatform session module) and the old/new major versions.
2. Before upgrading, capture a real session cookie and test whether the target version's default serializer can decode it.
3. If the test fails, implement a dual-read serializer and configure it via cookieSession<MySession> { serializer = ... }.
4. If migration is not feasible, plan to invalidate sessions and force re-authentication.

Missing Diagnostic Detail

Which exact artifact and major version pair are you upgrading between? The risk differs between the legacy ktor-server-sessions artifact and newer multiplatform splits, and between specific major releases.