## Summary Roll out [the feature](https://gitlab.com/gitlab-com/gl-infra/tenant-scale/cells-infrastructure/team/-/work_items/890) currently behind the `prevent_cross_cell_session_overwrite` feature flag. - DRI: @marcogreg - Team Slack channel: `#g_cells_infrastructure` > [!note] > Process and guidance live in the docs — this issue is just the commands and a place to track the rollout. > "Rolling out" means incrementally enabling the flag on GitLab.com to validate stability — it is not the same as releasing the feature, which happens when the flag is removed. > [Feature flag controls](https://docs.gitlab.com/development/feature_flags/controls/) · [Feature flag lifecycle](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) ## What is gated The flag `prevent_cross_cell_session_overwrite` (type `gitlab_com_derisk`, default off) gates a Rack middleware. Merge request: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/255824. Problem issue: https://gitlab.com/gitlab-com/gl-infra/tenant-scale/cells-infrastructure/team/-/work_items/890. All cells use the same session cookie name, `_gitlab_session`. Only the cookie value has the cell prefix, for example `cell-3-<sid>`. Path-based routing can send a request to a cell that does not own the cookie. That cell sees an anonymous visitor, creates a new empty session, and sends Set-Cookie with the same name. This overwrites the cookie of the owning cell and orphans that session. When the flag is on, the middleware runs after the app. It sets `rack.session.options[:skip] = true` when all of these are true: - Cells are enabled in config, and this cell has a session cookie prefix. - The visitor is not authenticated (no Warden user). - The incoming cookie value starts with `cell-` but not with the prefix of this cell. Then this cell saves no session and sends no Set-Cookie for that response. When the flag is off, or cells are not enabled, the middleware does nothing. The flag actor is `:current_request`. A percentage-of-actors rollout applies to a percentage of requests, not to a stable set of users. ## What could go wrong? - An anonymous visitor with the cookie of another cell gets no saved session on this cell. The CSRF token for forms (sign-in, sign-up), OAuth state, and flash messages do not survive to the next request on this cell. - A following form POST on this cell can fail the CSRF check. The result is `ActionController::InvalidAuthenticityToken` and HTTP 422. - Authenticated requests are not affected. Requests with no cookie, a cookie for this cell, or a cookie without the `cell-` prefix are not affected. - There is no data loss risk. The change only stops writes. - To roll back, set the flag to `false`. Watch: - Rate of `ActionController::InvalidAuthenticityToken` errors and HTTP 422 responses. - Reports of sign-in and sign-up failures. - Reports of users signed out of their owning cell. These reports should go down. ## Events <!-- Replace feature flag name in the link--> - [Exceptions with prevent_cross_cell_session_overwrite:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.exception.feature_flag_states.keyword:%22prevent_cross_cell_session_overwrite:1%22'),columns:!(json.exception.class,json.exception.message,json.extra.workflow_id,json.meta.caller_id),sort:!(!(json.time,desc)))) - [Events with prevent_cross_cell_session_overwrite:1](https://log.gprd.gitlab.net/app/discover#/?_g=(time:(from:now-1d,to:now))&_a=(index:'7092c4e2-4eb5-46f2-8305-a7da2edad090',query:(language:kuery,query:'json.feature_flag_states:%22prevent_cross_cell_session_overwrite:1%22'),columns:!(json.meta.caller_id,json.feature_flag_states),sort:!(!(json.time,desc)))) - [Error rate and other graphs by modifying the examples in the Visualization Library](https://log.gprd.gitlab.net/app/visualize#/?_g=h@358d019&s=FF%20Observability) Feature Flag events are only logged by default for feature flags marked for the current or future milestones. To enable while the feature flag is active, see https://docs.gitlab.com/development/feature_flags/#logging ## Rollout Run all production `/chatops` in [`#production`](https://gitlab.slack.com/archives/C101F3796) and cross-post the results to `#g_cells_infrastructure`. Background: [incremental rollout process](https://docs.gitlab.com/development/feature_flags/controls/#process), [feature actors](https://docs.gitlab.com/development/feature_flags/#feature-actors). **Non-production** ``` /chatops gitlab run feature set prevent_cross_cell_session_overwrite 50 --actors --dev --pre --staging --staging-ref /chatops gitlab run feature set prevent_cross_cell_session_overwrite true --dev --pre --staging --staging-ref ``` **Production** — percentage rollout (wait ≥15 min between steps, watch dashboards): ``` /chatops gitlab run feature set prevent_cross_cell_session_overwrite <percentage> --actors ``` Or target specific actors instead: ``` /chatops gitlab run feature set --project=gitlab-org/gitlab,gitlab-org/gitlab-foss prevent_cross_cell_session_overwrite true /chatops gitlab run feature set --group=gitlab-org,gitlab-com prevent_cross_cell_session_overwrite true /chatops gitlab run feature set --user=marcogreg prevent_cross_cell_session_overwrite true ``` ## Before global rollout Confirm the relevant gotchas before going to 100% — see [enabling a feature for GitLab.com](https://docs.gitlab.com/development/feature_flags/controls/#enabling-a-feature-for-gitlabcom): - [Docs + version history](https://docs.gitlab.com/development/documentation/feature_flags/) updated - [Breaking changes](https://docs.gitlab.com/development/documentation/release_notes/#deprecations-removals-and-breaking-changes) announced, if any - [Change management issue](https://handbook.gitlab.com/handbook/engineering/infrastructure-platforms/change-management/#feature-flags-and-the-change-management-process) opened, if required - [External API consumers](https://docs.gitlab.com/development/feature_flags/#do-not-use-feature-flags-in-external-api-consumers) handled with a fail-open mechanism, if applicable ## Cleanup Remove the flag once [deemed stable](https://handbook.gitlab.com/handbook/product-development/how-we-work/product-development-flow/feature-flag-lifecycle/#feature-flag-lifecycle) — see [cleaning up](https://docs.gitlab.com/development/feature_flags/controls/#cleaning-up). Track it here, or open a follow-up [Feature Flag Cleanup issue](https://gitlab.com/gitlab-org/gitlab/-/work_items/new?description_template=Feature%20Flag%20Cleanup). Remove the flag and its YAML definition from the codebase, then: ``` /chatops gitlab run release check <merge-request-url> <milestone> /chatops gitlab run feature delete prevent_cross_cell_session_overwrite --dev --pre --staging --staging-ref --production ``` ## Rollback ``` /chatops gitlab run feature set prevent_cross_cell_session_overwrite false # production /chatops gitlab run feature set prevent_cross_cell_session_overwrite false --dev --pre --staging --staging-ref # non-production /chatops gitlab run feature delete prevent_cross_cell_session_overwrite --dev --pre --staging --staging-ref --production # remove entirely ```