1
Diagnostic step 1
Mark sensitive endpoints with Cache-Control: private or no-store to prevent edge caching of authenticated responses; use s-maxage only for truly public assets.
FULL AI ANALYSIS
Next.js API behind Vercel Edge intermittently returns 403 due to cached edge responses dropping Cookie headers
Generated Oct 3, 2026, 12:35:03 AM
Analysis summary
Edge caches typically do not consider Cookie by default when caching; if a cached response is returned from edge without the Cookie forwarded, origin logic may be bypassed or see missing auth headers, causing 403. The root causes are likely a combination of cache-control directives that allow edge caching of responses that should be private, and the CDN serving cached responses without varying on Cookie. Changing caching to private or disabling edge caching for auth-protected endpoints ensures Cookie is always sent to origin or prevents caching of sensitive responses.
Possible causes
Edge node caches responses that should be private because Cache-Control/Vary headers don't instruct the CDN to vary by Cookie.
90%Misconfigured route-level caching (e.g., SSR pages set to s-maxage) causing private content to be cached and served without authentication context.
85%Vercel's default caching at the edge strips or ignores Cookie headers to maximize cache hit rate unless explicitly configured.
75%Edge function runtime differences (Edge vs Serverless) that affect header handling and cookie forwarding.
40%Suggested fixes
2
Diagnostic step 2
Send Vary: Cookie on responses that may legitimately vary by session so caches consider Cookie in the cache key (note: this can reduce cache efficiency and may still require CDN support).
3
Diagnostic step 3
Prefer serverless/regional functions for authenticated API logic that must always see full cookies rather than edge functions, or move session tokens to an Authorization header for stateless verification if feasible.
4
Diagnostic step 4
Instrument edge and origin with request/response header logs (without logging actual cookie values) to confirm whether Cookie is forwarded on cache-miss and whether cached responses are served without appropriate vary headers.
5
Diagnostic step 5
If uncertainty persists about Vercel edge behavior, open a support ticket with Vercel including request IDs and timestamps (do not share session cookie values) so they can inspect CDN cache key behavior. Consider adding a safeguard in the application to reject any cached response that lacks required authentication context rather than returning a 403 unexpectedly.