fix(pages): prevent request props from entering ISR - #3067
fix(pages): prevent request props from entering ISR#3067NathanDrake2406 wants to merge 16 commits into
Conversation
Pages that combine getStaticProps with App.getInitialProps can include request cookies or headers in app-level props. Shared ISR entries can then replay those values to later requests.\n\nTreat a custom App.getInitialProps as request-aware. Bypass ISR reads, writes, stale regeneration, fallback persistence, and on-demand persistence for these pages.
|
@codex review |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
commit: |
|
You have reached your Codex usage limits for security reviews. Please try again later. |
Performance benchmarksCompared 0 improved · 0 regressed · 6 within ±1.5%
View detailed results and traces 🟢 improvement · 🔴 regression · ⚫ change below 1.5% · paired base/head |
The production integration test still expected an ISR MISS and HIT transition. Custom App.getInitialProps now requires per-request rendering, so assert that both production responses omit the cache-state header.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b0e8fbe31d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Only a userland App.getInitialProps override bypasses ISR; the shim's inherited default keeps shared caching. Request-aware notFound results no longer carry a cache lifetime, and only-generated revalidation returns the 404 no-op without reading the cache.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e3f1456260
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…validation Request-aware App renders now emit the never-cache policy on HTML and _next/data responses, and revalidate values are still validated when the result bypasses the shared cache.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c8d6046af9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…he headers Fallback shells inherit the request-aware bypass, and every bypass site applies the never-cache policy through the CDN adapter so provider-owned edge headers are removed too.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3e7a8d40d4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The shared-cache bypass is now checked before the nonce branch, so a request-aware render always routes its never-cache policy through the CDN adapter.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b414ff90a7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Pages that combine getInitialProps with getStaticProps can mix request data with shared static output. Request-aware fallback and response short-circuit paths can also retain shared cache behavior. Reject the incompatible page exports, bypass fallback cache reads, and apply the CDN adapter never-cache policy to App response short-circuits. Focused tests cover each regression.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 59f6034779
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Development can accept an invalid page getInitialProps and getStaticProps pair that production rejects. Document short-circuits and recursive 404 responses can also retain provider cache headers after request-aware App rendering. Share the Next.js export validator across dev and production. Carry the source bypass through notFound handling, and apply the CDN adapter never-cache policy before every affected response exits.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ba194afacb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Reject invalid data exports before dev fallback rendering, carry request-aware cache bypass through early not-found results, and keep rendered no-store policy authoritative after staged headers merge.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 14d6c4698a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Use a canonical non-cacheable policy after the final header merge whenever the active CDN adapter detects an explicit storage opt-out, including provider-only no-store headers.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: adba844c51
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Keep rendered private browser cache policies while clearing conflicting CDN metadata, and validate incompatible Pages data exports before every development static-path exit.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: abb5ad7376
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Skip non-cacheable Pages prerender artifacts, preserve adapter no-store semantics for case-insensitive directives, and carry request-aware cache bypass through recursive 500 rendering.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3f8cc1f667
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0e63b3dd7f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5e059d1653
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 20772e7b3f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
You have reached your Codex usage limits for security reviews. Please try again later. |
Overview
getStaticPropspages with a customApp.getInitialPropsas request-aware at runtime and during prerendering.Why
App.getInitialPropsreceives the live request and can read cookies or headers. Vinext cannot prove that a custom implementation is request-independent.For example, a custom App can read a tenant cookie. A request for tenant A could store tenant A props in ISR. A later tenant B request could then receive those props. When the page also uses
getStaticProps, the combined output is not safe to share.getInitialPropswithgetStaticProps.privateandno-storethrough terminal paths and final header merges.no-cacheoutput eligible.What changed
notFound, 404, or 500 pathgetInitialPropsplusgetStaticPropsgetStaticPaths.Cache-Control: no-cacheMaintainer review path
packages/vinext/src/server/pages-page-data.tsandpages-data-export-compatibility.tsfor cache eligibility and page API compatibility.packages/vinext/src/server/pages-page-handler.ts,pages-page-response.ts, andpages-request-pipeline.tsfor policy propagation.packages/vinext/src/server/app-prerender-endpoints.tsandprod-server.tsfor static-path export validation before missing or empty path results.packages/vinext/src/build/prerender.tsfor default-build, fatal-error, and static-export boundaries.tests/for runtime, development, adapter, endpoint, and prerender regression coverage.Validation
no-cache, redirects, custom 404 output, fatal errors, and source-map error text.Commands
Risk / compatibility
App.getInitialPropscan render more often and do not produce reusable build output.getInitialPropsplusgetStaticPropscombination now fails prerender builds, including dynamic routes with missing or empty static paths.no-cacheremains compatible with prerender output; onlyprivateandno-storeprohibit sharing.Non-goals
App.getInitialPropsimplementation is request-independent.