BuidlZone-Labs/zicket-web

Shared Mutable Module State Leaks Data Across SSR Requests

Open

#174 opened on Jul 29, 2026

View on GitHub
 (9 comments) (0 reactions) (1 assignee)TypeScript (43 forks)auto 404
Stellar Wavebugdifficulty: mediumhelp wantedsecurity

Repository metrics

Stars
 (4 stars)
PR merge metrics
 (PR metrics pending)

Description

Category

Bug

Priority

High

Description

In lib/user-session-sync.ts, state is defined at module scope (let state = { anonymousBrowsing: false, walletConnected: false }). During Server-Side Rendering (SSR), useSyncExternalStore invokes getServerSnapshot = () => state. Because Node.js keeps module scope variables across incoming HTTP requests, modifying state during SSR leaks state across concurrent users.

Evidence from lib/user-session-sync.ts#L16-L19:

let state: SessionState = {
  anonymousBrowsing: false,
  walletConnected: false,
};

Proposed Solution

  1. Replace module-level mutable variables with React Context or scoped state providers (SessionProvider).
  2. Ensure SSR fallback getServerSnapshot returns a static default state object.

Acceptance Criteria

  • Session state is scoped per request / component tree using React Context.
  • No module-level mutable variables used for SSR snapshots.
  • Session persistence across tabs uses React Context + useSyncExternalStore safely.

Files

  • lib/user-session-sync.ts

Contributor guide

Research direction
Investigate how module level state is shared across SSR requests by tracing usage of getServerSnapshot in lib/user session sync.ts. Identify all places that mutate state and understand the React rendering lifecycle. Explore how to scope state with React Context and compare with existing patterns in the codebase.
Tech stack
reacttypescriptnodejs
Domain
full stack
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
ReactTypeScriptSSRGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
70