A common mistake is treating the first page and the next page as independent snapshots of the database. When the underlying list changes, offset-based pagination can drift and the UI can skip items or repeat them. Teams also overcomplicate the client side, when lazy-loading frames and stream updates can handle most of the interaction cleanly.
Where teams go wrong with infinite scroll
The biggest mistake is treating “page 1” and “page 2” as fixed snapshots instead of a live sequence. With offset-based pagination, inserts, deletes, or reordering between requests can shift the window, so users see duplicates, gaps, or items that seem to jump around. The problem is usually data consistency, not Hotwire itself.
A second error is overbuilding the browser side. Hotwire frames and stream updates can keep the interaction simple, but teams often add custom scroll listeners, bespoke state management, or fragile DOM bookkeeping that makes the experience harder to reason about and easier to break.
How Pagy and Hotwire should be used together
Pagy is best treated as the server-side pagination layer, while Hotwire handles progressive loading and UI updates. That division matters because the server remains the source of truth for ordering and continuation, and the client only asks for the next slice when the user reaches the trigger point.
For stable feeds, this pattern works well when the query has a deterministic sort key and the application can tolerate eventual movement in the list. If the dataset changes frequently, the practical fix is often to key pagination on an immutable cursor or another monotonic position rather than relying on a shifting offset. For background on the identity and lifecycle side of trust boundaries in modern systems, NHI Mgmt Group’s Ultimate Guide to Non-Human Identities is useful when you need to think about durable access paths and controlled change over time.
When the UI is implemented with Hotwire, the goal is to make each next-page request idempotent enough that a repeated fetch does not corrupt the feed state. That means the server response should define what the next segment is, instead of the browser trying to infer it from scroll position alone. The same basic discipline shows up in adjacent pagination and integrity guidance, including OWASP API Security Top 10 when APIs must return predictable, bounded, and authorized result sets.
What practitioners should verify before shipping
Pagination needs to be tested against live data changes, not only against a static fixture. Add checks for inserts at the top of the list, deletions from the current window, and sort changes while the user is still scrolling, because those are the conditions that expose drift.
What to verify: Confirm that the sort order is stable, the boundary between pages is explicit, and the same item cannot appear in two adjacent fetches unless that is an intentional product decision. Also verify that the loading trigger does not fire multiple overlapping requests, because duplicate fetches can mask pagination bugs and create confusing UI behavior.
What to measure: Track repeat-item incidents, missing-item complaints, and the rate of duplicate next-page requests. If those signals rise as content churn increases, the pagination model is too fragile for the data shape.
Practitioner takeaway: Infinite scroll succeeds when the server owns continuity and the client only owns presentation, any design that lets the browser improvise pagination state will eventually drift.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 13 — Network Monitoring and Defense | Infinite scroll needs reliable request handling and duplicate-load detection. |
| 8 — Audit Log Management | Scroll pagination bugs are easier to prove when request and item-sequence changes are logged. | |
| Recommendation — Monitor next-page requests and flag overlapping fetches or abnormal load patterns. Log pagination boundaries and repeated item fetches for troubleshooting. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | The answer emphasizes server-controlled access to the next result set and bounded continuation. |
| PR.DS — Data Security | Stable ordering and consistent result delivery protect the integrity of the visible feed. | |
| Recommendation — Enforce server-side authorization and continuation checks for each page request. Preserve ordering integrity so users do not see duplicated or missing records. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
