Next.js GET Cache Bypass via Multipart POST – Reproduces on Vercel.com

Hosting a Next.js app and ever wondered why you see POST requests returning 200 on an endpoint that only support GET? Probably not but it got me curious today. Turns out it might be increasing your hosting cost.

You can reproduce this against Vercel's own homepage:

curl -iX POST https://vercel.com -F 'payload={"message":"Testing multipart form data POST"}' | less

=>

HTTP/2 200 [...] x-powered-by: Next.js, Payload x-vercel-cache: BYPASS

<!DOCTYPE html><html class=...

=> Returns 200, cache is bypassed. Should be 405.

The behavior is also weird where the hosting type (dev, prod local, prod) matters as well as the type of POST request.

Link to my findings: https://github.com/vercel/next.js/issues/78070#issuecomment-...