Caching Authentication in Next.js 14 Server Components

[williamlmao]

I'm struggling to find an efficient way to handle authentication caching in Next.js 14 server components, particularly when using third-party auth providers like Supabase. The issue I'm facing is caching authentication across nested layout.tsx files.

Current Understanding and Attempts

Using unstable_cache

The docs for unstable_cache show an example of caching a user:

const getCachedUser = unstable_cache(
  async (id) => getUser(id),
  ['my-app-user']
);

However, this approach doesn't work when we don't have the user ID available as a cache key, which is often the case with auth providers that use cookies.

Supabase Auth Example

Here's how we typically get a user from Supabase auth:

const cookieStore = cookies()
const supabase = await createServerClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
  {
    cookies: {
      getAll() {
        return cookieStore.getAll()
      },
     ...
    },
  }
)

const user = await supabase.auth.getUser()

This approach uses cookies, which are dynamic data sources and can't be used inside a cache scope according to the docs.

The Challenges:

Components calling cookies() are dynamic and can't be cached.

Can't prop drill data between layout.tsx files. Docs say:

Passing data between a parent layout and its children is not possible. However, you can fetch the same data in a route more than once, and React will automatically dedupe the requests without affecting performance.

The Problem

If I can't cache supabase.auth.getUser(), and I also can't prop drill from one layout.tsx file to another, I believe my only solution is to make multiple requests to my auth server for a single view (that uses deeply nested layout.tsx files).

Question

Is there a recommended way to cache/share the supabase.auth.getUser() request (or similar auth requests) across the component tree in Next.js 14? The goal is to access the user across the app without sending multiple requests to the server for the same view. This should be scoped on a per-user per-session basis.

[icyJoseph]

Have you read through here? #63775

[williamlmao]

This is exactly what I was looking for - not sure how I missed it when searching. Thanks a lot!