Cursor rule

1---
2alwaysApply: false
3---
4 
5## Avoid Shared Module State for Request Data
6 
7For React Server Components and client components rendered during SSR, avoid using mutable module-level variables to share request-scoped data. Server renders can run concurrently in the same process. If one render writes to shared module state and another render reads it, you can get race conditions, cross-request contamination, and security bugs where one user's data appears in another user's response.
8 
9Treat module scope on the server as process-wide shared memory, not request-local state.
10 
11**Incorrect (request data leaks across concurrent renders):**
12 
13```tsx
14let currentUser: User | null = null
15 
16export default async function Page() {
17  currentUser = await auth()
18  return <Dashboard />
19}
20 
21async function Dashboard() {
22  return <div>{currentUser?.name}</div>
23}
24```
25 
26If two requests overlap, request A can set `currentUser`, then request B overwrites it before request A finishes rendering `Dashboard`.
27 
28**Correct (keep request data local to the render tree):**
29 
30```tsx
31export default async function Page() {
32  const user = await auth()
33  return <Dashboard user={user} />
34}
35 
36function Dashboard({ user }: { user: User | null }) {
37  return <div>{user?.name}</div>
38}
39```
40 
41Safe exceptions:
42 
43- Immutable static assets or config loaded once at module scope
44- Shared caches intentionally designed for cross-request reuse and keyed correctly
45- Process-wide singletons that do not store request- or user-specific mutable data
46 
47For static assets and config, see [Hoist Static I/O to Module Level](./server-hoist-static-io.md).
48