fix(backend): Fix issue with FAPI suffixed cookies disabled by dimkl · Pull Request #3789 · clerk/javascript

dimkl · 2024-07-23T18:31:33Z

Description

For production instances that use the latest ClerkJS and backend SDKs if the suffixed cookies are disabled in FAPI, in every page refresh a handshake is triggered.
To fix this we should use the un-suffixed cookies when the suffixed client_uat does not exist but the suffixed session exists.

Checklist

npm test runs as expected.
npm run build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

For production instances that use the latest ClerkJS and backend SDKs if the FAPI suffixed cookies are disabled, in every page refresh a handshake is triggered. To fix this we should use the un-suffixed cookies when the suffixed client_uat does not exist but the suffixed session exists.

changeset-bot · 2024-07-23T18:31:37Z

🦋 Changeset detected

Latest commit: d8bdf84

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 9 packages

Name	Type
@clerk/backend	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/nextjs	Patch
@clerk/remix	Patch
@clerk/clerk-sdk-node	Patch
@clerk/tanstack-start	Patch
@clerk/testing	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

dimkl · 2024-07-23T18:43:09Z

!snapshot

clerk-cookie · 2024-07-23T18:47:14Z

Hey @dimkl - the snapshot version command generated the following package versions:

Package	Version
@clerk/astro	1.0.2-snapshot.v22b1fc0
@clerk/backend	1.4.1-snapshot.v22b1fc0
@clerk/chrome-extension	1.1.6-snapshot.v22b1fc0
@clerk/clerk-js	5.10.1-snapshot.v22b1fc0
@clerk/clerk-expo	1.2.9-snapshot.v22b1fc0
@clerk/express	0.0.19-snapshot.v22b1fc0
@clerk/fastify	1.0.21-snapshot.v22b1fc0
gatsby-plugin-clerk	5.0.0-beta.45
@clerk/localizations	2.5.1-snapshot.v22b1fc0
@clerk/nextjs	5.2.6-snapshot.v22b1fc0
@clerk/remix	4.2.5-snapshot.v22b1fc0
@clerk/clerk-sdk-node	5.0.18-snapshot.v22b1fc0
@clerk/tanstack-start	0.1.9-snapshot.v22b1fc0
@clerk/testing	1.2.1-snapshot.v22b1fc0

Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/astro

npm i @clerk/astro@1.0.2-snapshot.v22b1fc0 --save-exact

@clerk/backend

npm i @clerk/backend@1.4.1-snapshot.v22b1fc0 --save-exact

@clerk/chrome-extension

npm i @clerk/chrome-extension@1.1.6-snapshot.v22b1fc0 --save-exact

@clerk/clerk-js

npm i @clerk/clerk-js@5.10.1-snapshot.v22b1fc0 --save-exact

@clerk/clerk-expo

npm i @clerk/clerk-expo@1.2.9-snapshot.v22b1fc0 --save-exact

@clerk/express

npm i @clerk/express@0.0.19-snapshot.v22b1fc0 --save-exact

@clerk/fastify

npm i @clerk/fastify@1.0.21-snapshot.v22b1fc0 --save-exact

gatsby-plugin-clerk

npm i gatsby-plugin-clerk@5.0.0-beta.45 --save-exact

@clerk/localizations

npm i @clerk/localizations@2.5.1-snapshot.v22b1fc0 --save-exact

@clerk/nextjs

npm i @clerk/nextjs@5.2.6-snapshot.v22b1fc0 --save-exact

@clerk/remix

npm i @clerk/remix@4.2.5-snapshot.v22b1fc0 --save-exact

@clerk/clerk-sdk-node

npm i @clerk/clerk-sdk-node@5.0.18-snapshot.v22b1fc0 --save-exact

@clerk/tanstack-start

npm i @clerk/tanstack-start@0.1.9-snapshot.v22b1fc0 --save-exact

@clerk/testing

npm i @clerk/testing@1.2.1-snapshot.v22b1fc0 --save-exact

nikosdouvlis · 2024-07-23T18:51:43Z

    const url = new URL(`https://${frontendApiNoProtocol}/v1/client/handshake`);
    url.searchParams.append('redirect_url', redirectUrl?.href || '');
-    url.searchParams.append('suffixed_cookies', authenticateContext.suffixedCookies.toString());
+    url.searchParams.append('suffixed_cookies', 'true');


Is this needed now?

I'm going to revert this because I think its not needed at the moment

For production instances that use the latest ClerkJS and backend SDKs if the FAPI suffixed cookies are disabled, in every page refresh a handshake is triggered. To fix this we should use the un-suffixed cookies when the suffixed session exists but the suffixed client_uat does not exist.

anagstef · 2024-07-23T18:52:38Z

+    // This case can be reproduced for production instances when new ClerkJS and backend SDK
+    // are used but the FF in FAPI is disabled


Suggested change

// This case can be reproduced for production instances when new ClerkJS and backend SDK

// are used but the FF in FAPI is disabled

nikosdouvlis · 2024-07-23T18:54:50Z

+    // In case of incorrectly setup suffixed cookies (session exists but client_uat missing)
+    // let's use the un-suffixed cookies to keep the existing behavior.
+    // This case can be reproduced for production instances when new ClerkJS and backend SDK
+    // are used but the FF in FAPI is disabled


Suggested change

// In case of incorrectly setup suffixed cookies (session exists but client_uat missing)

// let's use the un-suffixed cookies to keep the existing behavior.

// This case can be reproduced for production instances when new ClerkJS and backend SDK

// are used but the FF in FAPI is disabled

// If a suffixed session cookie exists but the corresponding client_uat cookie is missing, fallback to using

// unsuffixed cookies.

// This handle the scenario where an app has been deployed using an SDK version that supports suffixed

// cookies, but FAPI for its Clerk instance has the feature disabled (eg: if we need to temporarily disable the feature).

…enabled' into fix/backend-sdk-without-fapi-ff-enabled

Co-authored-by: Stefanos Anagnostou <anagstef@users.noreply.github.com>

Co-authored-by: Nikos Douvlis <nikosdouvlis@gmail.com> Co-authored-by: Stefanos Anagnostou <anagstef@users.noreply.github.com>

dimkl self-assigned this Jul 23, 2024

dimkl requested review from anagstef and nikosdouvlis July 23, 2024 18:31

clerk-cookie added the backend label Jul 23, 2024

Create eleven-suits-flow.md

22b1fc0

nikosdouvlis reviewed Jul 23, 2024

View reviewed changes

anagstef reviewed Jul 23, 2024

View reviewed changes

nikosdouvlis approved these changes Jul 23, 2024

View reviewed changes

dimkl force-pushed the fix/backend-sdk-without-fapi-ff-enabled branch from 22b1fc0 to aef391c Compare July 23, 2024 18:55

nikosdouvlis added 2 commits July 23, 2024 21:59

Merge remote-tracking branch 'origin/fix/backend-sdk-without-fapi-ff-…

084882b

…enabled' into fix/backend-sdk-without-fapi-ff-enabled

chore(repo): Wip

7b17760

nikosdouvlis marked this pull request as ready for review July 23, 2024 19:03

anagstef reviewed Jul 23, 2024

View reviewed changes

Comment thread packages/backend/src/tokens/authenticateContext.ts Outdated

anagstef approved these changes Jul 23, 2024

View reviewed changes

Update packages/backend/src/tokens/authenticateContext.ts

d8bdf84

Co-authored-by: Stefanos Anagnostou <anagstef@users.noreply.github.com>

dimkl enabled auto-merge (squash) July 23, 2024 19:19

dimkl merged commit 045fb93 into main Jul 23, 2024

dimkl deleted the fix/backend-sdk-without-fapi-ff-enabled branch July 23, 2024 19:31

clerk-cookie mentioned this pull request Jul 23, 2024

ci(repo): Version packages #3785

Merged

arvinxx mentioned this pull request Jul 24, 2024

🐛 fix: fix UNAUTHORIZED issue with clerk auth provider lobehub/lobehub#3299

Merged

7 tasks

brkalow pushed a commit that referenced this pull request Jul 24, 2024

fix(backend): Fix issue with FAPI suffixed cookies disabled (#3789)

04b15a2

Co-authored-by: Nikos Douvlis <nikosdouvlis@gmail.com> Co-authored-by: Stefanos Anagnostou <anagstef@users.noreply.github.com>

coderabbitai Bot mentioned this pull request Aug 5, 2026

Server: add secure native article audio transport sethwilsonUS/world-garden#214

Merged

Navigation Menu

Uh oh!

fix(backend): Fix issue with FAPI suffixed cookies disabled - #3789

fix(backend): Fix issue with FAPI suffixed cookies disabled#3789
dimkl merged 6 commits into
mainfrom
fix/backend-sdk-without-fapi-ff-enabled

dimkl commented Jul 23, 2024 •

edited

Loading

Uh oh!

changeset-bot Bot commented Jul 23, 2024 •

edited

Loading

Uh oh!

dimkl commented Jul 23, 2024

Uh oh!

clerk-cookie commented Jul 23, 2024

Uh oh!

nikosdouvlis Jul 23, 2024

Uh oh!

nikosdouvlis Jul 23, 2024

Uh oh!

anagstef Jul 23, 2024

Uh oh!

nikosdouvlis Jul 23, 2024

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		// This case can be reproduced for production instances when new ClerkJS and backend SDK
		// are used but the FF in FAPI is disabled

Uh oh!

Conversation

dimkl commented Jul 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Type of change

Uh oh!

changeset-bot Bot commented Jul 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

dimkl commented Jul 23, 2024

Uh oh!

clerk-cookie commented Jul 23, 2024

Uh oh!

nikosdouvlis Jul 23, 2024

Choose a reason for hiding this comment

Uh oh!

nikosdouvlis Jul 23, 2024

Choose a reason for hiding this comment

Uh oh!

anagstef Jul 23, 2024

Choose a reason for hiding this comment

Uh oh!

nikosdouvlis Jul 23, 2024

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dimkl commented Jul 23, 2024 •

edited

Loading

changeset-bot Bot commented Jul 23, 2024 •

edited

Loading