Server side NextJS

[brandanking-decently]

How does this handle requests called server side? We use the access token to get user information and send info back based on this. Is it possible that due to caching a user could get another users information.

I was going to use a custom function to generate the key, however, it seems like when the generated key function is called it doesn't receive data passed to the request via an interceptor. The use case I have is that I pass the access token to axios via an interceptor but that access token isn't part of the request when generating the key

[arthurfiorette]

Yes, a module-scoped cache on a Next.js server can be shared by multiple requests, so authenticated responses need to be partitioned correctly.

The recommended HTTP solution is for the API to return:

Vary: Authorization

Axios Cache Interceptor handles this automatically with the default vary: true, creating separate cache entries for different authorization headers.

Make sure the interceptor adding Authorization runs before the cache interceptor. Axios request interceptors run in reverse registration order, so register the auth interceptor after setupCache():

const api = setupCache(axios.create());

api.interceptors.request.use((config) => {
  config.headers.set("Authorization", `Bearer ${getToken()}`);
  return config;
});

Also avoid assigning the same explicit id to authenticated requests, because an explicit ID bypasses automatic key generation unless you partition that ID yourself.

For especially sensitive responses, disabling caching or using request-scoped storage is still the safest option. Vary: Authorization also stores authorization-derived metadata and the generated IDs use the configured key generator, so it should not be treated as the only security boundary for a process-wide cache.

Docs:

• https://axios-cache-interceptor.js.org/config/request-specifics#cache-vary
• https://axios-cache-interceptor.js.org/guide/interceptors