### Information about bug
When users used the plattform, we found out that some…times the users just switched from User A to User B from time to time. it was very hard to pinpoint where the issue lied.
i found those three issues that have the same problem:
#47046
#50932
#35048
Those all have the same error and i am referencing them so people can find one (possible) solution for that here.
I investigated the network traffic and found that the exact time the user switches is when the `https://erp.example.com/website_script.js` is called (har below).
There the session-id from UserA is sent and the session-id from UserB is returned.
# Problem
My Nginx that is in front of ErpNext was configured to "Cache Assets". website_script is clearly an asset and the same for every user.
**Setting Set-Cookie headers with session IDs and user information on static JS files is never acceptable.**
# Solution
I have two Solutions, one that you can do instantly to resolve the issue, one that erpnext has to fix to ensure that we can use caching properly
## Meantime
Disable "Cache Assets" in Nginx Proxy Manager
or just use (if not enabled per default)
```env
proxy_ignore_headers Set-Cookie;
proxy_hide_header Set-Cookie;
```
or use any other configuration method to disable caching
## Long-Term
ErpNext should be altered to not send Cookies that are user-specific with static requests as this is not the standard and may not work with common proxies.
### Module
other
### Version
```json
{
"frappe": "15.93.0",
"erpnext": "15.93.1"
}
```
### Installation method
docker
### Relevant log output / Stack trace / Full Error Message.
```shell
{
"startedDateTime": "2026-01-21T09:20:50.972+01:00",
"request": {
"bodySize": 0,
"method": "GET",
"url": "https://erp.example.com/website_script.js",
"httpVersion": "HTTP/2",
"headers": [
{
"name": "Host",
"value": "erp.example.com"
},
{
"name": "User-Agent",
"value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko/20100101 Firefox/148.0"
},
{
"name": "Accept",
"value": "*/*"
},
{
"name": "Accept-Language",
"value": "en-US,de-AT;q=0.9,en;q=0.8"
},
{
"name": "Accept-Encoding",
"value": "gzip, deflate, br, zstd"
},
{
"name": "Referer",
"value": "https://erp.example.com/timesheets"
},
{
"name": "DNT",
"value": "1"
},
{
"name": "Sec-GPC",
"value": "1"
},
{
"name": "Connection",
"value": "keep-alive"
},
{
"name": "Cookie",
"value": "tmp_id=3a0cc5da; sid=b0c4c0sdfsse95959a965c88de54653c0ede7c72d9c137b2; system_user=yes; full_name=User%20A; user_id=userA%40example.com; user_image=/files/IMAGE_USER_A.jpg"
},
{
"name": "Sec-Fetch-Dest",
"value": "script"
},
{
"name": "Sec-Fetch-Mode",
"value": "no-cors"
},
{
"name": "Sec-Fetch-Site",
"value": "same-origin"
},
{
"name": "Priority",
"value": "u=1"
},
{
"name": "Pragma",
"value": "no-cache"
},
{
"name": "Cache-Control",
"value": "no-cache"
},
{
"name": "TE",
"value": "trailers"
}
],
"cookies": [
{
"name": "tmp_id",
"value": "3a0cc5da"
},
{
"name": "sid",
"value": "b0c4c066c87easdfeee95959a965c88de54653c0ede7c72d9c137b2"
},
{
"name": "system_user",
"value": "yes"
},
{
"name": "full_name",
"value": "User A"
},
{
"name": "user_id",
"value": "userA@example.com"
},
{
"name": "user_image",
"value": "/files/IMAGE_USER_A.jpg"
}
],
"queryString": [],
"headersSize": 687
},
"response": {
"status": 200,
"statusText": "",
"httpVersion": "HTTP/2",
"headers": [
{
"name": "server",
"value": "openresty"
},
{
"name": "date",
"value": "Wed, 21 Jan 2026 08:20:50 GMT"
},
{
"name": "content-type",
"value": "text/javascript; charset=utf-8"
},
{
"name": "content-length",
"value": "25"
},
{
"name": "x-page-name",
"value": "website_script.js"
},
{
"name": "x-from-cache",
"value": "False"
},
{
"name": "set-cookie",
"value": "sid=4076359f3a2f26sdfss9f412b28c5df39d5e6002adfe2b898871c; Expires=Wed, 28 Jan 2026 10:18:14 GMT; Max-Age=612000; HttpOnly; Path=/; SameSite=Lax"
},
{
"name": "set-cookie",
"value": "system_user=yes; Path=/; SameSite=Lax"
},
{
"name": "set-cookie",
"value": "full_name=User%20B; Path=/; SameSite=Lax"
},
{
"name": "set-cookie",
"value": "user_id=userB%40example.com; Path=/; SameSite=Lax"
},
{
"name": "set-cookie",
"value": "user_image=/files/IMG_USER_B.jpg_compressed.JPEG; Path=/; SameSite=Lax"
},
{
"name": "x-frame-options",
"value": "SAMEORIGIN"
},
{
"name": "strict-transport-security",
"value": "max-age=63072000; includeSubDomains; preload"
},
{
"name": "x-content-type-options",
"value": "nosniff"
},
{
"name": "x-xss-protection",
"value": "1; mode=block"
},
{
"name": "referrer-policy",
"value": "same-origin, strict-origin-when-cross-origin"
},
{
"name": "expires",
"value": "Thu, 22 Jan 2026 00:30:00 GMT"
},
{
"name": "cache-control",
"value": "max-age=58150"
},
{
"name": "x-served-by",
"value": "erp.example.com"
},
{
"name": "X-Firefox-Spdy",
"value": "h2"
}
],
"cookies": [
{
"name": "sid",
"value": "4076359f3a44ss0af189f412b28c5df39d5e6002adfe2b898871c"
},
{
"name": "system_user",
"value": "yes"
},
{
"name": "full_name",
"value": "User B"
},
{
"name": "user_id",
"value": "userB@example.com"
},
{
"name": "user_image",
"value": "/files/IMG_USER_B.jpg_compressed.JPEG"
}
],
"content": {
"mimeType": "text/javascript; charset=utf-8",
"size": 25,
"text": "// website_script.js\n\n\n\n\n"
},
"redirectURL": "",
"headersSize": 934,
"bodySize": 959
},
"cache": {},
"timings": {
"blocked": 0,
"dns": 0,
"connect": 0,
"ssl": 0,
"send": 0,
"wait": 73,
"receive": 0
},
"time": 73,
"_securityState": "secure",
"serverIPAddress": "192.0.2.1",
"connection": "443",
"pageref": "page_1"
}
```
