feat(core): add default cache control headers for GET endpoints

nextauthjs · Feb 8, 2025 · 742b826 · 742b826
1 parent 918a6ac
commit 742b826
Show file tree

Hide file tree

Showing 2 changed files with 35 additions and 4 deletions.
diff --git a/packages/next-auth/src/core/index.ts b/packages/next-auth/src/core/index.ts
@@ -166,7 +166,21 @@ export async function AuthHandler<
       }
       case "csrf":
         return {
-          headers: [{ key: "Content-Type", value: "application/json" }],
+          headers: [
+            { key: "Content-Type", value: "application/json" },
+            {
+              key: "Cache-Control",
+              value: "private, no-cache, no-store",
+            },
+            {
+              key: "Pragma",
+              value: "no-cache",
+            },
+            {
+              key: "Expires",
+              value: "0",
+            },
+          ],
           body: { csrfToken: options.csrfToken } as any,
           cookies,
         }

diff --git a/packages/next-auth/src/core/routes/session.ts b/packages/next-auth/src/core/routes/session.ts
@@ -32,7 +32,25 @@ export default async function session(
 
   const response: ResponseInternal<Session | {}> = {
     body: {},
-    headers: [{ key: "Content-Type", value: "application/json" }],
+    headers: [
+      { key: "Content-Type", value: "application/json" },
+      ...(isUpdate
+        ? []
+        : [
+            {
+              key: "Cache-Control",
+              value: "private, no-cache, no-store",
+            },
+            {
+              key: "Pragma",
+              value: "no-cache",
+            },
+            {
+              key: "Expires",
+              value: "0",
+            },
+          ]),
+    ].filter(Boolean),
     cookies: [],
   }
 
@@ -98,8 +116,7 @@ export default async function session(
   } else {
     try {
       // @ts-expect-error -- adapter is checked to be defined in `init`
-      const { getSessionAndUser, deleteSession, updateSession } =
-        adapter
+      const { getSessionAndUser, deleteSession, updateSession } = adapter
       let userAndSession = await getSessionAndUser(sessionToken)
 
       // If session has expired, clean up the database