Prevent Cache Poisoning in ISR and SSR Routes

// ❌ Long revalidation on user-specific content
// app/dashboard/page.tsx
export const revalidate = 3600 // Caches for 1 hour — but content varies by user!
 
export default async function Dashboard() {
  const session = await auth()
  const data = await getUserData(session.user.id)
  return <DashboardView data={data} /> // User A sees User B's cached dashboard
}

// ❌ Setting permissive cache headers on dynamic API routes
// app/api/user/route.ts
export async function GET(request: NextRequest) {
  const user = await getCurrentUser(request)
  return NextResponse.json(user, {
    headers: {
      'Cache-Control': 'public, s-maxage=60', // CDN caches user-specific data!
    },
  })
}

// ❌ ISR page that renders differently based on cookies/headers
// app/pricing/page.tsx
export const revalidate = 600
 
export default async function Pricing() {
  const country = headers().get('x-country') // Varies by request
  const prices = await getPrices(country)     // But ISR caches one version!
  return <PriceTable prices={prices} />
}

// ✅ Never cache user-specific content with ISR
// app/dashboard/page.tsx
export const dynamic = 'force-dynamic' // No caching
 
export default async function Dashboard() {
  const session = await auth()
  const data = await getUserData(session.user.id)
  return <DashboardView data={data} />
}

// ✅ Private cache headers for user-specific API responses
// app/api/user/route.ts
export async function GET(request: NextRequest) {
  const user = await getCurrentUser(request)
  return NextResponse.json(user, {
    headers: {
      'Cache-Control': 'private, no-store', // Never cached by CDN
    },
  })
}

// ✅ Use generateStaticParams for known variants, not request-based branching
// app/pricing/[country]/page.tsx
export async function generateStaticParams() {
  return [{ country: 'us' }, { country: 'eu' }, { country: 'uk' }]
}
 
export default async function Pricing({ params }: { params: { country: string } }) {
  const prices = await getPrices(params.country)
  return <PriceTable prices={prices} />
}

# Find ISR pages that also read cookies or headers (likely misconfigured)
grep -rn "revalidate" src/app --include="*.ts" --include="*.tsx" -l | \
  xargs grep -l "cookies\|headers\|auth\|session"
# Find API routes setting public cache headers
grep -rn "s-maxage\|public.*max-age" src/app/api --include="*.ts"