Bug fix demo: the dashboard shows the previous user's data after logout/login

Symptom

User A logs out and user B logs in on the same browser. The dashboard still shows A's data until someone does a hard reload. This is a UX bug and also a privacy problem.

Root causes (usually more than one at once)

Client cache key doesn't include the user. For example, queryKey: ['dashboard'] means B gets A's cached result.
Cache isn't cleared on logout. React Query, SWR, Apollo or a Redux/Zustand/context store survives logout because a logout doesn't reload the page.
A per-user API response is marked cacheable. Cache-Control: public, max-age=… with no Vary: Cookie lets the browser or a CDN/proxy reuse A's response for B.

Fix

// client: key by user + clear on logout
useQuery({ queryKey: ['dashboard', user?.id], queryFn: ..., enabled: !!user })
await fetch('/logout', { method: 'POST', credentials: 'include' }); queryClient.clear();

// server (Express): per-user responses are never shared
res.set({ 'Cache-Control': 'private, no-store', Vary: 'Cookie' })

Proof

npm test runs one test against each build: the buggy build shows Bob Alice's dashboard until a "hard reload", and the fixed build shows Bob his own data immediately.

# tests 2
# pass 2
# fail 0

Files

server.js: minimal Node API with sessions; --fixed switches the headers
client.js: a stand-in for the React data layer (query cache plus an HTTP cache that respects Cache-Control)
react-fix.jsx: the same fix in a real React/TanStack Query app
test.js: the reproduction and the regression test

Run it: node --test test.js (Node 18+, no dependencies). Download zip

Honest scope note: the React layer is modelled in plain Node so the test runs without a browser. In a real project I'd reproduce the bug in your actual app (browser DevTools, the network tab and React Query Devtools) before changing anything.