Public available page shows preview version if `res.revalidate('/some-page')` is called by a user with enabled preview mode

[tilman]

Verify canary release

• I verified that the issue exists in the latest Next.js canary release

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 21.1.0: Wed Oct 13 17:33:01 PDT 2021; root:xnu-8019.41.5~1/RELEASE_ARM64_T6000
Binaries:
  Node: 14.19.3
  npm: 6.14.17
  Yarn: 1.22.19
  pnpm: 7.5.0
Relevant packages:
  next: 12.2.2
  eslint-config-next: 12.2.2
  react: 18.2.0
  react-dom: 18.2.0

What browser are you using? (if relevant)

Chrome

How are you deploying your application? (if relevant)

Vercel

Describe the Bug

If a user with enabled preview mode is triggering an on-demand ISR from the same browser which has the preview-mode cookies set, the page get's build in preview mode and the preview-mode version of it is made publicly available via the CDN for all visitors

Expected Behavior

Only show preview mode to visitors which have preview mode enabled and ignore preview mode for requests which have been made via res.revalidate

Link to reproduction

only on vercel, therefore no stackblitz

To Reproduce

1.) add const {isPreview} = useRouter(); console.log(isPreview) to any page of your next.js project
2.) enable the preview mode for the current session via an API route and res.setPreviewData({});. The console.log is logging isPreview = true
3.) trigger an ondemand isr with an API route and res.revalidate('/some-page')
4.) open /some-page in a new private tab. Because we have no cookies the preview mode is disabled. But still the console.log will log isPreview = true because the page revalidation was triggered from an user with active preview mode

[maxch-aa]

I'm experiencing the same issue.

[maxch-aa]

Just verified that the page generated with the preivew data does appear on the CDN for all requests.

This is what I have in the API handler:

res.clearPreviewData();

try {
  await res.revalidate("/");
} catch (err) {
  console.log(err);
}

[github-actions]

This closed issue has been automatically locked because it had no new activity for a month. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.