do you use server side props for session data?

We’re on Next.js App Router, not the Pages Router so we don’t use getServerSideProps for session. Session comes from an HttpOnly cookie, resolved on the server via cookies() + API fetch (cache: "no-store") and on the client via /api/session (forced dynamic + no-store headers)

our next.config.js has Cache-Control: public, max-age=300, must-revalidate

Could this be making it so one user’s full page (HTML + RSC payload) is being served to another?

Railway says they don't cache the HTML but maybe the RSC is to blame? I don't know enough about NextJS to confidently answer that though

Tell me more about this RSC payload.

But yes, we explicitly never cache text/html

What would you like to know

For now i removed the global cache from next config and so far no complaints about people being visually logged in as someone else hmmm but still monitoring

What is the mime type of the RSC requests, or really any mime type for responses that contain user data.

For session data it's application/json which contains the user data for that user logged in

then the rest is just text/html for pages

What specfic Cache-Control values do you set for the json content?

Just what you sent above? public, max-age=300, must-revalidate

public, max-age=300, must-revalidate was an old global header but I removed.

So at the time of opening this thread, public, max-age=300, must-revalidate were the only values for cache control?

yes at the time of opening the thread that was what was used

Then that allows caching of the JSON, so the CDN was doing what it was told, unless I am misunderstanding?

You explicitly disable that now, so you should be good to re-enable, we will respect no-store and no-cache.

Wait so uh question

The /api/session file had no-store headers but then the global one had a 5 min cache, so the file specific headers don't get respected but instead the global one?

What headers prevail would be something you would need to look into on your end.

Got it!

Have you since re-enabled the CDN?

Yes I had re-enabled it here after I removed that global 5m cache header https://discord.com/channels/713503345364697088/1487226044053458944/1487513163426697246

Sounds good, then am I good to solve?

I think so, yes

<:salute:1137099685417451530>