dotnet/yarp · error · InvalidOperationException

Session affinity is disabled for cluster.

Error message

Session affinity is disabled for cluster.

What it means

Thrown by BaseHashCookieSessionAffinityPolicy.AffinitizeResponse when `config.Enabled` is not true. Identical contract to the encrypted-policy variant (error 46) but for hash-based cookie affinity policies, which compute the affinity key as a hash of destination rather than encrypting it.

Source

Thrown at src/ReverseProxy/SessionAffinity/BaseHashCookieSessionAffinityPolicy.cs:34

    private readonly ILogger _logger;
    private readonly TimeProvider _timeProvider;

    public BaseHashCookieSessionAffinityPolicy(TimeProvider timeProvider, ILogger logger)
    {
        ArgumentNullException.ThrowIfNull(timeProvider);
        ArgumentNullException.ThrowIfNull(logger);

        _timeProvider = timeProvider;
        _logger = logger;
    }

    public abstract string Name { get; }

    public void AffinitizeResponse(HttpContext context, ClusterState cluster, SessionAffinityConfig config, DestinationState destination)
    {
        if (!config.Enabled.GetValueOrDefault())
        {
            throw new InvalidOperationException("Session affinity is disabled for cluster.");
        }

        if (context.RequestAborted.IsCancellationRequested)
        {
            // Avoid wasting time if the client is already gone.
            return;
        }

        // Affinity key is set on the response only if it's a new affinity.
        if (!context.Items.ContainsKey(AffinityKeyId))
        {
            var affinityKey = GetDestinationHash(destination);
            var affinityCookieOptions = AffinityHelpers.CreateCookieOptions(config.Cookie, context.Request.IsHttps, _timeProvider);

            // CodeQL [SM02373] - Whether CookieOptions.Secure is used depends on YARP configuration, and session affinity may be used in non-HTTPS setups. Hash-based affinity policies do not intend to provide privacy protection. See https://learn.microsoft.com/aspnet/core/fundamentals/servers/yarp/session-affinity#key-protection.
            context.Response.Cookies.Append(config.AffinityKeyName, affinityKey, affinityCookieOptions);
        }
    }

View on GitHub (pinned to bd11867bee)

Solutions

1. Set `SessionAffinity.Enabled = true` for clusters using hash-cookie affinity.
2. Guard custom call sites with `config.Enabled.GetValueOrDefault()` before invoking AffinitizeResponse.
3. Double-check the policy type registered matches an enabled cluster.

Example fix

// before
SessionAffinity = new SessionAffinityConfig { Policy = "HashCookie", AffinityKeyName = "Yarp.Affinity" }
// after
SessionAffinity = new SessionAffinityConfig { Enabled = true, Policy = "HashCookie", AffinityKeyName = "Yarp.Affinity" }

if (!config.Enabled.GetValueOrDefault())
    throw new InvalidOperationException("Enable SessionAffinity before calling AffinitizeResponse.");

static bool AffinityEnabled(SessionAffinityConfig? config) =>
    config is not null && config.Enabled.GetValueOrDefault();

When it happens

Trigger: AffinitizeResponse invoked on a cluster whose SessionAffinityConfig.Enabled is false/null, where the policy is a hash-cookie variant (e.g. ArrCookie, HashCookie).

Common situations: Cluster config registers a hash-cookie affinity policy but omits `Enabled`. Custom code/test invokes AffinitizeResponse on a disabled cluster.

Related errors

• Session affinity is disabled for cluster.
• Session affinity is disabled for cluster {cluster.ClusterId}
• Session affinity is disabled for cluster {cluster.ClusterId}
• Unknown transform: {string.Join(';', rawTransform.Keys)}
• The transform contains more parameters than expected: {strin

AI-assisted analysis of dotnet/yarp@bd11867bee (2026-08-13). Data as JSON: /api/errors/8d5a8678eaba3b9d. Report an issue: GitHub.