clerk_active_context cookie is not partition-aware (non-deterministic session-cookie write gate in CHIPS/partitioned cross-origin iframes)

[jacekradko]

Summary

The clerk_active_context cookie is the one auth cookie in clerk-js that is not partition-aware. In a partitioned / blocked-third-party-cookie context (Chrome CHIPS), it becomes unreadable inside a cross-origin iframe, which silently degrades the cross-tab/cross-context arbitration that gates the session-cookie write.

Details

createActiveContextCookie() sets only SameSite=None, with no Partitioned attribute and no usePartitionedCookies plumbing:

// packages/clerk-js/src/core/auth/cookies/activeContext.ts
const attributes = { secure: getSecureAttribute('None') };

By contrast, the session cookie (and __client_uat / dev-browser cookies) compute a Partitioned attribute when partitioned cookies are enabled or when running in a cross-origin iframe:

// packages/clerk-js/src/core/auth/cookies/session.ts
const isPartitioned = options.usePartitionedCookies();
const sameSite = isPartitioned || inCrossOriginIframe() || requiresSameSiteNone() ? 'None' : 'Lax';
const partitioned = isPartitioned && secure;

AuthCookieService.updateSessionCookie() gates the cookie write on document.hasFocus() OR isCurrentContextActive(), and isCurrentContextActive() reads clerk_active_context. In a partitioned cross-origin iframe the session cookie lives in the partitioned jar while clerk_active_context does not, so:

• the active-context read returns undefined and isCurrentContextActive() falls back to true (which happens to unblock the write today), or
• in configurations where the cookie is readable-but-mismatched, the gate falls closed and drops writes.

Either way the multi-context arbitration the gate is meant to provide does not behave the same inside a partitioned iframe as it does in a first-party tab. The behavior is config-dependent rather than deterministic.

Impact

Today this is mostly latent because the absent-cookie branch falls open. But it makes the session-cookie write-gate non-deterministic in partitioned/CHIPS embedded contexts, and it is a latent correctness hazard for the multi-tab/multi-context active-organization logic when an app runs inside a cross-origin iframe.

Suggested fix

Make clerk_active_context partition-aware: thread the same partitioned-attribute computation used by session.ts (set Partitioned when usePartitionedCookies() / inCrossOriginIframe()) so it is written and read in the same partition as the session cookie. Note the browser treats partitioned and non-partitioned cookies of the same name as distinct, so a migration/cleanup of the old unpartitioned cookie is also needed.

Context

Found while fixing the embedded-iframe session-refresh bug (a Clerk app in a cross-origin iframe returning 401s after tab re-activation). That fix adds a visibilitychange refresh trigger and lets a visible cross-origin iframe write the cookie; this partitioned-attribute defect was deliberately left out of scope for that change and filed separately.

[github-actions]

Hello 👋

We currently close issues after 40 days of inactivity. It's been 30 days since the last update here. If we missed this issue, please reply here. Otherwise, we'll close this issue in 10 days.

As a friendly reminder: The best way to see an issue fixed is to open a pull request. If you're not sure how to do that, please check out our contributing guide.

Thanks for being a part of the Clerk community! 🙏

[github-actions]

Hello again 👋

After 40 days of no activity, we'll close this issue. Keep in mind, I'm just a robot, so if I've closed this issue in error, please reply here and my human colleagues will reopen it.

As a friendly reminder: The best way to see an issue fixed is to open a pull request. If you're not sure how to do that, please check out our contributing guide.

Thanks for being a part of the Clerk community! 🙏