2026-09-15

The sign-out link that prefetching followed

On our platform's dashboard, every signed-in page bounced to the login screen as soon as the overview had been displayed. The defect did not exist in development, and the local end-to-end validation could not see it: it came from an optimisation Next.js applies only to production builds. Found on 10 July 2026.

A sign-out link on GET

The overview carried a “Sign out” link to a route that destroyed the session on receiving a GET request. In development, clicking the link signed you out, and nothing else called that route. The local validation, run on that build, was green.

Production prefetching

In production, Next.js prefetches the links present on the page to speed up navigation, and it never does so in development. Prefetching the sign-out link therefore sent the GET request that destroyed the session, with no click at all, every time the overview was displayed. Every signed-in page then bounced to the login screen.

The fix

The sign-out route now answers POST only, and the link became a form whose button sends that POST; a prefetch never issues a POST. Verified on a local production build: a GET on the route returns 405 and the session survives, submitting the form signs out and clears the cookie, and the session survives prefetching in an automated browser, with no console error.

The rule we keep

An action that changes state is never triggered by a GET, whatever the framework: it is a principle of the protocol, and prefetching is one of the ways it reminds you. An end-to-end validation runs on the production build, because development does not execute the same optimisations.

A prefetch never issues a POST, and an action that changes state is never triggered by a GET.