{"record":{"id":"8d5a8678eaba3b9d","repo":"dotnet/yarp","slug":"session-affinity-is-disabled-for-cluster-8d5a86","errorCode":null,"errorMessage":"Session affinity is disabled for cluster.","messagePattern":"Session affinity is disabled for cluster\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/ReverseProxy/SessionAffinity/BaseHashCookieSessionAffinityPolicy.cs","lineNumber":34,"sourceCode":"    private readonly ILogger _logger;\n    private readonly TimeProvider _timeProvider;\n\n    public BaseHashCookieSessionAffinityPolicy(TimeProvider timeProvider, ILogger logger)\n    {\n        ArgumentNullException.ThrowIfNull(timeProvider);\n        ArgumentNullException.ThrowIfNull(logger);\n\n        _timeProvider = timeProvider;\n        _logger = logger;\n    }\n\n    public abstract string Name { get; }\n\n    public void AffinitizeResponse(HttpContext context, ClusterState cluster, SessionAffinityConfig config, DestinationState destination)\n    {\n        if (!config.Enabled.GetValueOrDefault())\n        {\n            throw new InvalidOperationException(\"Session affinity is disabled for cluster.\");\n        }\n\n        if (context.RequestAborted.IsCancellationRequested)\n        {\n            // Avoid wasting time if the client is already gone.\n            return;\n        }\n\n        // Affinity key is set on the response only if it's a new affinity.\n        if (!context.Items.ContainsKey(AffinityKeyId))\n        {\n            var affinityKey = GetDestinationHash(destination);\n            var affinityCookieOptions = AffinityHelpers.CreateCookieOptions(config.Cookie, context.Request.IsHttps, _timeProvider);\n\n            // CodeQL [SM02373] - Whether CookieOptions.Secure is used depends on YARP configuration, and session affinity may be used in non-HTTPS setups. Hash-based affinity policies do not intend to provide privacy protection. See https://learn.microsoft.com/aspnet/core/fundamentals/servers/yarp/session-affinity#key-protection.\n            context.Response.Cookies.Append(config.AffinityKeyName, affinityKey, affinityCookieOptions);\n        }\n    }","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/dotnet/yarp/blob/bd11867bee7df522e7fd3effb08a9c85fd616908/src/ReverseProxy/SessionAffinity/BaseHashCookieSessionAffinityPolicy.cs#L16-L52","documentation":"Thrown by BaseHashCookieSessionAffinityPolicy.AffinitizeResponse when `config.Enabled` is not true. Identical contract to the encrypted-policy variant (error 46) but for hash-based cookie affinity policies, which compute the affinity key as a hash of destination rather than encrypting it.","triggerScenarios":"AffinitizeResponse invoked on a cluster whose SessionAffinityConfig.Enabled is false/null, where the policy is a hash-cookie variant (e.g. ArrCookie, HashCookie).","commonSituations":"Cluster config registers a hash-cookie affinity policy but omits `Enabled`. Custom code/test invokes AffinitizeResponse on a disabled cluster.","solutions":["Set `SessionAffinity.Enabled = true` for clusters using hash-cookie affinity.","Guard custom call sites with `config.Enabled.GetValueOrDefault()` before invoking AffinitizeResponse.","Double-check the policy type registered matches an enabled cluster."],"exampleFix":"// before\nSessionAffinity = new SessionAffinityConfig { Policy = \"HashCookie\", AffinityKeyName = \"Yarp.Affinity\" }\n// after\nSessionAffinity = new SessionAffinityConfig { Enabled = true, Policy = \"HashCookie\", AffinityKeyName = \"Yarp.Affinity\" }","handlingStrategy":"validation","validationCode":"if (!config.Enabled.GetValueOrDefault())\n    throw new InvalidOperationException(\"Enable SessionAffinity before calling AffinitizeResponse.\");","typeGuard":"static bool AffinityEnabled(SessionAffinityConfig? config) =>\n    config is not null && config.Enabled.GetValueOrDefault();","tryCatchPattern":null,"preventionTips":["Set Enabled=true on clusters using hash-cookie affinity.","Guard custom call sites with config.Enabled.","Validate cluster affinity config at startup."],"tags":["session-affinity","config","yarp"],"backgroundTag":null,"analyzedSha":"bd11867bee7df522e7fd3effb08a9c85fd616908","analyzedAt":"2026-08-13T21:29:49.359Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}