Disabling traits persistence prevents traits to be used in segment evaluation

[EmFl]

How are you running Flagsmith

• Self Hosted with Docker
• Self Hosted with Kubernetes
• SaaS at flagsmith.com
• Some other way (add details in description below)

Describe the bug

Hello,
I don't know if it's a bug or a misunderstanding on my part, but I've recently disabled the "Persist traits when using client-side SDK keys" option for which the tooltip says : "If enabled, Flagsmith will persist any non-transient traits sent by SDKs using client-side keys when remotely evaluating flags."

My understanding was that the traits would still be used for evaluating the segments, but would not get persisted to the database.
However, on my system (running the latest version of flagsmith at the time of writing this issue), my traits are not used in the evaluation and I simply get the environment default values.

I think this is related to https://github.com/Flagsmith/flagsmith/blob/main/api/environments/sdk/serializers.py#L193-L197
Where we should return instead of an empty list, all traits as transient.
something like:

    def validate_traits(self, traits: typing.List[dict] = None):  # type: ignore[no-untyped-def,type-arg,assignment]
        request = self.context["request"]
        if traits and not request.environment.trait_persistence_allowed(request):
            for trait in traits:
                trait["transient"] = True
        return traits

Steps To Reproduce

1. Go to environment settings / sdk settings
2. turn off Persist traits when using client-side SDK keys
3. call getidentity with traits
4. Confirm that the traits are missing from response and flags are only env default

Expected behavior

Traits (transient or not) should be used to evaluate returned flags

Screenshots

No response

[khvn26]

Hi @EmFl, thanks for reporting this!

After investigating, the current behaviour is actually intentional. The "Persist traits when using client-side SDK keys" toggle is a security boundary — when disabled, it's designed to completely ignore any traits sent by client-side SDKs, not just skip persisting them. This prevents untrusted clients from sending arbitrary traits to match segments they shouldn't have access to.

When this setting is off, traits should only be set server-side using a server-side SDK key. Client-side SDKs can still read flags for identities whose traits have been set server-side.

We've opened #6782 to clarify the toggle name and documentation so this is less confusing going forward.

We're also aware that our Edge API in SaaS does not correctly maintain this behaviour — we're working on delivering a fix for this, and will promptly communicate everyone affected.