I had a edge case where a user had the jwt token from another user. And was authenticated that way. I was lucky that the user was a coworker. I didn't had time to check it better because after a refresh the session was gone. I think maybe isr cache gave the token maybe to the user?

I use netlify. Not sure if this is possible? I I only use isr on the homepage and not the protected section of the app. I already implented a getuser check for the protected section instead of just checking if there is a user. But still i want to know if it is possible that the cache somehow gave the jwt to the wrong user?