How did auth credentials get cached via CDN?

[balazsorban44]

Hi, I am running a Next.js app on Azure App Services, with Azure CDN in front of it.

Doing this after a discussion I had with @Timer

Using https://github.com/auth0/nextjs-auth0 as an auth solution.

It has some pages using getStaticPaths with fallback: true and getStaticProps, but have also some data that is clientside fetched because it needs authentication.
After logging in, my user information somehow got cached, and even if someone else logs in, they get my credentials.!? It looks like my credentials were saved in the CDN somehow. I would like to provide more info if necessary, also I was unsure where I should report this.

Someone has a good idea/experienced something similar?

[Timer]

It sounds like the CDN is caching something it shouldn't. What are the response headers sent for the specific page?

[Timer]

Do you see caching on the API endpoint (on Azure)? Try "custom origin".

[balazsorban44]

You mean if the pages under /api are cached on Azure?

I called an /api/foo endpoint, that returns information about the logged in user. The headers:

Azure deploy: x-cache: TCP_HIT
Vercel deploy: x-vercel-cache: MISS

[balazsorban44]

Do you see caching on the API endpoint (on Azure)? Try "custom origin".

Tried "custom origin", did not help 😢

[balazsorban44]

Trying to set a no cache rule on /api/ now:

will update on if this helps.

I think this solved the issue! Is it something needed to be done, or this should already be handled by Next.js and is a bug 🐛, then?

[Timer]

This seems to be an Azure bug to assume everything is cacheable by default. The cache headers for API routes do not instruct the CDN to cache—there must be a default setting somewhere.

You can verify this by running the server locally and inspecting the cache-control header returned by an API route.

---

Maybe configure the "Set if missing" option to not cache.