We discovered this in the 3.x version, but it still applies in 4.x
If a restricted user hits a cacheable page before it has loaded for an unrestricted user, Drupal's JS array cache gets truncated.
This happens because restrict_ip_js_alter removes any JS other than jQuery and its own. Presumably, this might be a security feature but it causes unpredictable bugs,
Install a module or a theme that adds custom JS to the site -- a menu JS like Big Menu is a good one.
It does not matter if JS aggregation is enabled or not.
You can look in the cache_datatable for the JS cache for debugging purposes.
What's happening:
I see two possible fixes here:
None.
None.
None.
Active
4.0
Code
I think the only question here is "Do we care about the potential security risk of JS leaking during the redirect process?"
I fell like that's a pretty low risk, but it does provide direction on how to solve this issue.