Can cache data be accessed by other users

[osaxon]

Hi everyone

We're looking into implementing tanstack query for one of our apps at my organisation.
One of the benefits we've highlighted with the library - caching query responses - has also been flagged as a potential risk.
Our app has lots of users with various permissions that control what data they have access to from our back end services.
The question raised is that if tanstack query caches query responses for User A, is there any scenario where another user who doesn't have the same permissions as User A could see or access the caches data?

From searching previous posts, I've found that by default the cache lives solely in memory and isn't persisted anywhere. But I wasn't able to find anything specifically related to whether the cache can be accessed by anyone other than the person who initiated the fetch.

[TkDodo]

the cache lives in memory, similar to if you had put the result of a fetch into useState. There's no difference to what you're probably doing right now in terms of data access.

[osaxon]

Thanks @TkDodo , that's helpful.
And I'm assuming that would be the same if a user was to log out of the application and then another user logged in, the cached data wouldn't be accessible?
(also, I've been reading your blog posts about Tanstack query and been finding it very helpful so thank you for your help!)

[TkDodo]

are you talking about logging in on the same machine in the same browser tab?

that's a different scenario and it depends on how logout is implemented. if there is a full page refresh in the mix, then data will be gone. If you just redirect with a soft navigation to the /login page, data will still be cached unless you manually clear it

[osaxon]

yes the scenario would be if two users with different permissions. If the first user logs out and the second user logs in, is there any chance of the cached data for the first user being leaked to the second.
I think I understand better now - so long as we implement a page refresh during logout, the data won't be available as it will be cleared

[TkDodo]

or you just call queryClient.clear() when you log out