From 3ddc6096e50c09c01f4a7aa2ca214faf5c83874a Mon Sep 17 00:00:00 2001 From: Gustavo Valverde Date: Wed, 14 Oct 2026 09:27:24 +0100 Subject: [PATCH] fix(demo): keep OAuth token responses uncacheable in development (#11742) --- demo/nextjs/app/api/auth/[...all]/route.ts | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/demo/nextjs/app/api/auth/[...all]/route.ts b/demo/nextjs/app/api/auth/[...all]/route.ts index 16dfa39fb3..052a70575d 100644 --- a/demo/nextjs/app/api/auth/[...all]/route.ts +++ b/demo/nextjs/app/api/auth/[...all]/route.ts @@ -18,10 +18,7 @@ function addCorsHeaders(url: URL, headers: Headers) { ); headers.set("Access-Control-Allow-Origin", "*"); headers.set("Access-Control-Allow-Headers", "authorization, content-type"); - headers.set( - "Cache-Control", - "public, max-age=15, stale-while-revalidate=15, stale-if-error=86400", - ); + // Leave Cache-Control to the library: token responses must be no-store (RFC 6749 ยง5.1). } }