Browser-side cache invalidation for authentik doesn't trigger after rebuild #42

New issue

Open

opened 2026-07-23 23:01:20 +02:00 by Klemens · 0 comments

Klemens commented

2026-07-23 23:01:20 +02:00

Owner

While Authentik does use ESBuild in order to reference javascripts chunks by hash, which by design does not allow for old cached scripts to load, the FlowInterface-(version).js itself, which calls these script chunks, only gets cache busted if its version changed. Because we often rebuild authentik without a proper version change (for patches or nixpkg update) the file name stays the same and thus no new script is loaded into the users browser. This leads to issues where the chunked javascript files do not correspond with the cached FlowInterface-(version).js file and 404's occur.

While Authentik [does use ESBuild](https://github.com/goauthentik/authentik/blob/93d8a94c2fbd562a7ddca3d5c7fcf30a45a8daab/web/scripts/build-web.mjs#L110) in order to reference javascripts chunks by hash, which by design does not allow for old cached scripts to load, the [FlowInterface-(version).js](https://auth.elbforge.org/static/dist/flow/FlowInterface-2026.5.6.js) itself, which calls these script chunks, only gets [cache busted if its version changed](https://github.com/goauthentik/authentik/blob/93d8a94c2fbd562a7ddca3d5c7fcf30a45a8daab/authentik/flows/templates/if/flow.html#L39). Because we often rebuild authentik without a proper version change (for patches or nixpkg update) the file name stays the same and thus no new script is loaded into the users browser. This leads to issues where the chunked javascript files do not correspond with the cached FlowInterface-(version).js file and 404's occur.