Update fetch cache handling with POST requests

[ijjk]

This updates to no longer skip caching POST or authed requests with the fetch cache and instead we bail when cookies() or headers() is used prior which is a better heuristic to signal user specific data would be related to the fetch request.

x-ref: slack thread

Bug

• Related issues linked using fixes #number
• Integration tests added
• Errors have a helpful link attached, see contributing.md

[mattrobenolt]

👋 hi @ijjk, is there any context that you may share publicly about why this change was done? This is a very interesting change and one that I suspect had a specific motivation behind, but has a major ramifications by deviating from the expected behaviors of HTTP caching by default.

This is already causing issues popping up on our end since our library uses fetch() with a POST and an Authorization header, which both should by any typical measure, be considered unsafe for caching. I was rather shocked to go down this rabbit hole and find that this behavior is newly intentional.

I'm also fine pulling this out into it's own issue, I was just first seeking some background on the motivation for this behavior, and I suspect it's going to cause a lot of confusion or bugs or security issues for your users.

To add to this, I'm going to refer to RFC7231:

Section 3 calls out criteria on which a response must not be cached. Both the POST method is defined as unsafe in section 4.2.1. Section 3.2 explicitly says Authorization header shouldn't be cached unless explicitly allowed.

Personally, I'm fine if this is a product choice by Vercel/Next.js, I just want to make sure this decision to go against the RFCs is intentional for a tangible reason, so we can work around it.

[ijjk]

@mattrobenolt This was changed as we noticed a lot of CMS requests and graphql requests failing to cache since they leverage POST and have authorization. Instead we went for a heuristic where if headers() or cookies() are read before a POST request or authorized request is done then we don't cache those by default as they can be request specific.

Note: the default can always be overridden on a per-fetch or per-page basis via cache: 'no-store', or export const fetchCache (related fetchCache documentation and related per-request documentation)