Repository navigation
Stale merchant details can leak across logout/login sessions #657
Description
Problem
MyAccountPageViewModel now prefers ApplicationCache.GetMerchantDetails() over fetching fresh merchant details from the API.
Impact
Merchant details are not cleared on logout, so a user who logs out and then logs in as a different merchant can see the previous merchant's name/details in My Account until the cache is refreshed elsewhere.
Reproduction
- Log in as merchant A.
- Open My Account so merchant details are cached.
- Log out.
- Log in as merchant B.
- Open My Account.
Expected
My Account should show merchant B's details.
Actual
Cached details from merchant A can be reused.
Suggested fix
Clear cached merchant details on logout, or scope the cached value to the active session/merchant and always refresh when the session changes.
Activity
StuartFerguson commentedon Jul 9, 2026
Clarification: the merchant details cache should be overwritten on a subsequent successful login, so the main risk here is stale data being visible between logout and the next completed login flow. Clearing the cached merchant details on logout is still a sensible preventative measure to avoid any accidental reuse before the new session repopulates it.