for authjs it's not a problem, idk for lucia

Can you setup no cache for pages behind a middleware in Next?

I have heard that there is an issue when it comes to caching and they try to make it opt-in in v15.

Could you please test it on some of your app that uses it. I haven't done anything with Next yet, to test it. Thanks in advance.

... and just the way the browser works by default.

The browser is the client and nextjs is by default the server. So I don't think that you will be able to archive that

the guy @!=tgt says he can achieve that

1. bfcache is disabled if you send this header Cache-Control: "no-cache, no-store, must-revalidate". It can be sent in middleware or next.config.js

2. this is not a security issue. it is the same as when the user takes the screenshot of the authenticated app, then log out. the user can read the authenticated content for that session only, but they cannot make any authenticated actions.

yes, the user can simply press the browser back button, but they cannot do anything other than sitting in that page and viewing the content. they cannot, say, submit a form in there, unless your code by itself has a security bug

Maybe for you, but for me it IS a security issue. My app will be used in schools and shared spaces where many people rotate on one computer. It's important to me to do it right. And currently, using Inertia this is impossible to do. Remix seems to be refreshing stuff on back button by default. But I will check your solution as well.

yes then the keyword to search for is "bfcache". just send a good cache-control header and browsers wont cache it

OK, thanks. will try.

To check what I mean go here: https://demo.inertiajs.com/

and do some stuff as john doe after login

go back and forth and then log out.

and click on back button in the browser. you will go back even if you are logged out. That's super dangerous on shared computers in schools and public places.

Just did

Use NextAuth.js
Then, you can solve this problem @Himalayan

when you log out and then press the back button does it show what you saw as logged in user?

Yeah, it seems to be working OK with NextAuth.js. The back button doesn't show the content of the protected area like Inertia.js does. So that's nice to know.

By the way, what is the difference between NextAuth.js and Auth.js? Which one should I install in Next 14?

no

great