From b9e6824cd8c52a80df8220e7345e534b23a51470 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Sat, 26 Sep 2026 14:07:56 -0700
Subject: [PATCH] fix(api): prevent caching authenticated workflow variables

---
 apps/sim/app/api/workflows/[id]/variables/route.ts | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/apps/sim/app/api/workflows/[id]/variables/route.ts b/apps/sim/app/api/workflows/[id]/variables/route.ts
index d6b0dd3115f..09f6e6fb694 100644
--- a/apps/sim/app/api/workflows/[id]/variables/route.ts
+++ b/apps/sim/app/api/workflows/[id]/variables/route.ts
@@ -153,18 +153,12 @@ export const GET = withRouteHandler(
         }
       }
 
-      // Add cache headers to prevent frequent reloading
-      const variableHash = JSON.stringify(variables).length
-      const headers = new Headers({
-        'Cache-Control': 'max-age=30, stale-while-revalidate=300', // Cache for 30 seconds, stale for 5 min
-        ETag: `"variables-${workflowId}-${variableHash}"`,
-      })
-
       return NextResponse.json(
         { data: variables },
         {
           status: 200,
-          headers,
+          // Cookie-authenticated variables must not be stored or reused by HTTP caches.
+          headers: { 'Cache-Control': 'private, no-store' },
         }
       )
     } catch (error) {