fix: prevent caching issues on authenticated pages #332
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Without Vary: Cookie, CDNs can't tell User A and User B apart and might serve cached authenticated content to the wrong person. We now set proper cache headers (Vary: Cookie, Cache-Control: private, no-store, etc.) on any request with auth context. Only affects authenticated routes - public pages still cache normally. Vercel handles this fine, but CloudFront/SST/OpenNext needed the explicit headers.
nicknisi
force-pushed
the
nicknisi/caching
branch
from
f2132ae to
d6b4d2e
Compare
nicknisi
changed the title
nicknisi
force-pushed
the
nicknisi/caching
branch
from
8d0aef0 to
dbdcc45
Compare
dandorman
approved these changes
Nov 3, 2025
Contributor
dandorman
left a comment
dandorman
left a comment
There was a problem hiding this comment.
The overall approach seems good. Are there any of the server-action stuff (switchOrganization) that need similar treatment?
Member
Author
Correct me if I'm wrong but I think those should all be fine. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a potential session crossover vulnerability in CDN environments (particularly CloudFront with SST/OpenNext deployments).
Without
Vary: Cookie, CDNs can't differentiate between User A and User B, potentially serving User A's cached authenticated content to User B.Changes
Headers now set on authenticated requests:
Cache-Control: private, no-store, must-revalidateVary: Cookie(critical - tells CDNs to differentiate users)CDN-Cache-Control: no-store(CloudFront/Vercel specific)x-middleware-cache: no-cache(OpenNext/SST specific)Pragma: no-cache(HTTP/1.0 compatibility)Detection logic:
Auth callback routes are always protected via direct function call.