Availability data refreshed from server on every calendar view load
Why it matters
Serving stale availability data is a direct cause of double-bookings. When a customer books slot A, that change must be visible to every other client on the next calendar load — not after a session refresh or browser restart. Client-side caches without TTLs violate CWE-362 (concurrent resource access) and ISO 25010 functional correctness: two users see the same slot as open and both confirm. The downstream effect is a support ticket, a refund, and a damaged reputation. Booking platforms live and die by schedule integrity; a single double-booking erodes trust faster than any competitor can.
Severity rationale
Critical because stale availability displayed to the user is the direct mechanical cause of double-bookings, which are unrecoverable without manual intervention and refunds.
Remediation
Add month and year (or equivalent time-period identifiers) to the useEffect dependency array in your calendar component so a fresh fetch fires on every navigation, not just on mount. Include a cache-buster parameter or set Cache-Control: no-cache on the server endpoint.
useEffect(() => {
fetch(`/api/availability?month=${month}&year=${year}&t=${Date.now()}`)
.then(r => r.json())
.then(setSlots)
}, [month, year]) // re-runs on every period change
On the API route in src/app/api/availability/route.ts, set the response header:
return new Response(JSON.stringify(slots), {
headers: { 'Cache-Control': 'no-cache, no-store, must-revalidate' },
})
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Calendar & Availability Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-362 — Race Condition (TOCTOU) — stale availability data enables concurrent double-booking
- iso-25010:2011 · functional-correctness — Functional Correctness — calendar must reflect true current state
Taxons
History
- 2026-04-18·v1.0.0·Initial import from booking-calendar-availability·automated