Next.js GET Cache Bypass via Multipart POST – Reproduces on Vercel.com

Next.js GET Cache Bypass via Multipart POST – Reproduces on Vercel.com(github.com)

2 points by elbajo 288 days ago | 1 comment

elbajo 288 days ago |

Hosting a Next.js app and ever wondered why you see POST requests returning 200 on an endpoint that only support GET? Probably not but it got me curious today. Turns out it might be increasing your hosting cost.

You can reproduce this against Vercel's own homepage:

curl -iX POST https://vercel.com -F 'payload={"message":"Testing multipart form data POST"}' | less

HTTP/2 200 [...] x-powered-by: Next.js, Payload x-vercel-cache: BYPASS

<!DOCTYPE html><html class=...

=> Returns 200, cache is bypassed. Should be 405.

The behavior is also weird where the hosting type (dev, prod local, prod) matters as well as the type of POST request.

Link to my findings: https://github.com/vercel/next.js/issues/78070#issuecomment-...