feat(nextjs): Add CSP in middleware - #5493

Merged
jacekradko merged 36 commits into
mainfrom
feat/nextjs-inject-csp-in-middleware
Apr 4, 2025
Merged

feat(nextjs): Add CSP in middleware#5493
jacekradko merged 36 commits into
mainfrom
feat/nextjs-inject-csp-in-middleware

Conversation

@jacekradko

@jacekradkojacekradko commented Mar 31, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

Description

Adding the ability to automatically inject the CSP header through @clerk/nextjs middleware.

You can now configure clerkMiddleware with an optional param contentSecurityPolicy like the following example:

exportdefaultclerkMiddleware(async(auth,request)=>{if(!isPublicRoute(request)){awaitauth.protect();}},{debug: process.env.NODE_ENV!=="production",contentSecurityPolicy: {mode: "strict-dynamic",directives: {"connect-src": ["sub.domain.com"],}}});

Closes: SDKI-913

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

@changeset-bot

changeset-botBot commented Mar 31, 2025•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: d822452

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages
NameType
@clerk/backendMinor
@clerk/nextjsMinor
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/remixPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented Mar 31, 2025•
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment
NameStatusPreviewCommentsUpdated (UTC)
clerk-js-sandbox⬜️ Skipped (Inspect)Apr 4, 2025 7:35pm

@jacekradko
jacekradko requested review from a team and CopilotMarch 31, 2025 16:41
CopilotAI reviewed Mar 31, 2025
View reviewed changes

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR introduces a new CSP header utility to automatically inject a Clerk‐compatible Content Security Policy header, including support for nonce generation in strict-dynamic mode.

  • Adds a new file (content-security-policy.ts) with functions to create, merge, and format CSP headers.
  • Updates clerkMiddleware.ts to integrate the CSP header injection into the middleware flow and adjusts ClerkProvider.tsx to use a dedicated nonce header.
  • Enhances test coverage by adding comprehensive tests for the new CSP functionality.

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file
FileDescription
packages/nextjs/src/server/content-security-policy.tsIntroduces CSP header creation and processing functions, including nonce support.
packages/nextjs/src/server/clerkMiddleware.tsIntegrates CSP header injection into the middleware and logs CSP details in debug mode.
packages/nextjs/src/server/tests/content-security-policy.test.tsProvides extensive tests for various CSP header scenarios and edge cases.
packages/nextjs/src/app-router/server/ClerkProvider.tsxAdjusts nonce extraction by adding support for a dedicated X-Nonce header.
.changeset/vast-clubs-speak.mdUpdates the changelog to record the addition of Clerk-compatible CSP header support.
Comments suppressed due to low confidence (2)

packages/nextjs/src/server/content-security-policy.ts:200

  • [nitpick] Consider pre-formatting the directive values into an array once before sorting to avoid redundant calls to CSPDirectiveManager.formatValue; this could improve performance and ensure consistent ordering.
const sortedValues = Array.from(values).sort((a, b) => {

packages/nextjs/src/server/clerkMiddleware.ts:196

  • [nitpick] Ensure that the CSP header injection logic properly validates and sanitizes input values (both the host and any existing CSP header) to avoid potential header conflicts or injection issues, especially as the feature evolves.
if (options.injectCSP) {

@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradkoforce-pushed the feat/nextjs-inject-csp-in-middleware branch from c5b6e27 to 76e237bCompareApril 1, 2025 14:30
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

jacekradko commented Apr 3, 2025

Copy link
Copy Markdown
ContributorAuthor

!snapshot

@clerk-cookie

clerk-cookie commented Apr 3, 2025

Copy link
Copy Markdown
Collaborator

Hey @jacekradko - the snapshot version command generated the following package versions:

PackageVersion
@clerk/agent-toolkit0.0.18-snapshot.v20250403202028
@clerk/astro2.5.1-snapshot.v20250403202028
@clerk/backend1.26.1-snapshot.v20250403202028
@clerk/chrome-extension2.2.25-snapshot.v20250403202028
@clerk/clerk-js5.59.1-snapshot.v20250403202028
@clerk/elements0.23.10-snapshot.v20250403202028
@clerk/clerk-expo2.9.8-snapshot.v20250403202028
@clerk/expo-passkeys0.2.2-snapshot.v20250403202028
@clerk/express1.4.1-snapshot.v20250403202028
@clerk/fastify2.2.1-snapshot.v20250403202028
@clerk/localizations3.13.6-snapshot.v20250403202028
@clerk/nextjs6.14.0-snapshot.v20250403202028
@clerk/nuxt1.5.1-snapshot.v20250403202028
@clerk/clerk-react5.25.7-snapshot.v20250403202028
@clerk/react-router1.2.1-snapshot.v20250403202028
@clerk/remix4.5.13-snapshot.v20250403202028
@clerk/shared3.3.1-snapshot.v20250403202028
@clerk/tanstack-react-start0.13.1-snapshot.v20250403202028
@clerk/testing1.4.35-snapshot.v20250403202028
@clerk/themes2.2.28-snapshot.v20250403202028
@clerk/types4.50.3-snapshot.v20250403202028
@clerk/vue1.4.7-snapshot.v20250403202028

Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit

npm i @clerk/agent-toolkit@0.0.18-snapshot.v20250403202028 --save-exact

@clerk/astro

npm i @clerk/astro@2.5.1-snapshot.v20250403202028 --save-exact

@clerk/backend

npm i @clerk/backend@1.26.1-snapshot.v20250403202028 --save-exact

@clerk/chrome-extension

npm i @clerk/chrome-extension@2.2.25-snapshot.v20250403202028 --save-exact

@clerk/clerk-js

npm i @clerk/clerk-js@5.59.1-snapshot.v20250403202028 --save-exact

@clerk/elements

npm i @clerk/elements@0.23.10-snapshot.v20250403202028 --save-exact

@clerk/clerk-expo

npm i @clerk/clerk-expo@2.9.8-snapshot.v20250403202028 --save-exact

@clerk/expo-passkeys

npm i @clerk/expo-passkeys@0.2.2-snapshot.v20250403202028 --save-exact

@clerk/express

npm i @clerk/express@1.4.1-snapshot.v20250403202028 --save-exact

@clerk/fastify

npm i @clerk/fastify@2.2.1-snapshot.v20250403202028 --save-exact

@clerk/localizations

npm i @clerk/localizations@3.13.6-snapshot.v20250403202028 --save-exact

@clerk/nextjs

npm i @clerk/nextjs@6.14.0-snapshot.v20250403202028 --save-exact

@clerk/nuxt

npm i @clerk/nuxt@1.5.1-snapshot.v20250403202028 --save-exact

@clerk/clerk-react

npm i @clerk/clerk-react@5.25.7-snapshot.v20250403202028 --save-exact

@clerk/react-router

npm i @clerk/react-router@1.2.1-snapshot.v20250403202028 --save-exact

@clerk/remix

npm i @clerk/remix@4.5.13-snapshot.v20250403202028 --save-exact

@clerk/shared

npm i @clerk/shared@3.3.1-snapshot.v20250403202028 --save-exact

@clerk/tanstack-react-start

npm i @clerk/tanstack-react-start@0.13.1-snapshot.v20250403202028 --save-exact

@clerk/testing

npm i @clerk/testing@1.4.35-snapshot.v20250403202028 --save-exact

@clerk/themes

npm i @clerk/themes@2.2.28-snapshot.v20250403202028 --save-exact

@clerk/types

npm i @clerk/types@4.50.3-snapshot.v20250403202028 --save-exact

@clerk/vue

npm i @clerk/vue@1.4.7-snapshot.v20250403202028 --save-exact

nikosdouvlis
nikosdouvlis approved these changes Apr 4, 2025
View reviewed changes
Comment threadpackages/nextjs/src/server/clerkMiddleware.ts Outdated
// and move the logic in clerk/backend
if (requestState.headers) {
requestState.headers.forEach((value, key) => {
if (key === 'Content-Security-Policy') {

@nikosdouvlisnikosdouvlisApr 4, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: we can replace this string this with the constants import from @clerk/backend

brkalow
brkalow reviewed Apr 4, 2025
View reviewed changes
Comment thread.changeset/vast-clubs-speak.md Outdated
brkalow
brkalow approved these changes Apr 4, 2025
View reviewed changes

@brkalowbrkalow left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👏

@jacekradko
jacekradko merged commit 2cceeba into mainApr 4, 2025
@jacekradko
jacekradko deleted the feat/nextjs-inject-csp-in-middleware branch April 4, 2025 20:25
@clerk-cookieclerk-cookie mentioned this pull request Apr 4, 2025
Merged
@jacekradkojacekradko mentioned this pull request Apr 7, 2025
Merged
2 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jescalanjescalanjescalan left review comments
Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@brkalowbrkalowbrkalow approved these changes
@nikosdouvlisnikosdouvlisnikosdouvlis approved these changes
+1 more reviewer
@panteliselefpanteliselefpanteliselef left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

backendfastifynextjs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@jacekradko@clerk-cookie@jescalan@brkalow@nikosdouvlis@panteliselef
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(nextjs): Add CSP in middleware - #5493
Merged
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Apr 4, 2025
Merged
feat(nextjs): Add CSP in middleware#5493
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Conversation
@jacekradko
@jacekradkojacekradko
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Adding the ability to automatically inject the CSP header through @clerk/nextjs middleware.
You can now configure clerkMiddleware with an optional param contentSecurityPolicy like the following example:
exportdefaultclerkMiddleware(async(auth,request)=>{if(!isPublicRoute(request)){awaitauth.protect();}},{debug: process.env.NODE_ENV!=="production",contentSecurityPolicy: {mode: "strict-dynamic",directives: {"connect-src": ["sub.domain.com"],}}});
Closes: SDKI-913
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d822452
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendMinor
@clerk/nextjsMinor
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/remixPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
NameStatusPreviewCommentsUpdated (UTC)
clerk-js-sandbox⬜️ Skipped (Inspect)Apr 4, 2025 7:35pm
@jacekradko
jacekradko
requested review from
a team and CopilotMarch 31, 2025 16:41
CopilotAI
reviewed
Mar 31, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR introduces a new CSP header utility to automatically inject a Clerk‐compatible Content Security Policy header, including support for nonce generation in strict-dynamic mode.
  • Adds a new file (content-security-policy.ts) with functions to create, merge, and format CSP headers.
  • Updates clerkMiddleware.ts to integrate the CSP header injection into the middleware flow and adjusts ClerkProvider.tsx to use a dedicated nonce header.
  • Enhances test coverage by adding comprehensive tests for the new CSP functionality.
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
FileDescription
packages/nextjs/src/server/content-security-policy.tsIntroduces CSP header creation and processing functions, including nonce support.
packages/nextjs/src/server/clerkMiddleware.tsIntegrates CSP header injection into the middleware and logs CSP details in debug mode.
packages/nextjs/src/server/tests/content-security-policy.test.tsProvides extensive tests for various CSP header scenarios and edge cases.
packages/nextjs/src/app-router/server/ClerkProvider.tsxAdjusts nonce extraction by adding support for a dedicated X-Nonce header.
.changeset/vast-clubs-speak.mdUpdates the changelog to record the addition of Clerk-compatible CSP header support.
Comments suppressed due to low confidence (2)
packages/nextjs/src/server/content-security-policy.ts:200
  • [nitpick] Consider pre-formatting the directive values into an array once before sorting to avoid redundant calls to CSPDirectiveManager.formatValue; this could improve performance and ensure consistent ordering.
const sortedValues = Array.from(values).sort((a, b) => {

packages/nextjs/src/server/clerkMiddleware.ts:196
  • [nitpick] Ensure that the CSP header injection logic properly validates and sanitizes input values (both the host and any existing CSP header) to avoid potential header conflicts or injection issues, especially as the feature evolves.
if (options.injectCSP) {

@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradkoforce-pushed
the
feat/nextjs-inject-csp-in-middleware
branch
from
c5b6e27 to
76e237bCompareApril 1, 2025 14:30
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradko
commented
Apr 3, 2025

Copy link


Copy Markdown

ContributorAuthor
!snapshot
@clerk-cookie
clerk-cookie
commented
Apr 3, 2025

Copy link


Copy Markdown

Collaborator
Hey @jacekradko - the snapshot version command generated the following package versions:
PackageVersion
@clerk/agent-toolkit0.0.18-snapshot.v20250403202028
@clerk/astro2.5.1-snapshot.v20250403202028
@clerk/backend1.26.1-snapshot.v20250403202028
@clerk/chrome-extension2.2.25-snapshot.v20250403202028
@clerk/clerk-js5.59.1-snapshot.v20250403202028
@clerk/elements0.23.10-snapshot.v20250403202028
@clerk/clerk-expo2.9.8-snapshot.v20250403202028
@clerk/expo-passkeys0.2.2-snapshot.v20250403202028
@clerk/express1.4.1-snapshot.v20250403202028
@clerk/fastify2.2.1-snapshot.v20250403202028
@clerk/localizations3.13.6-snapshot.v20250403202028
@clerk/nextjs6.14.0-snapshot.v20250403202028
@clerk/nuxt1.5.1-snapshot.v20250403202028
@clerk/clerk-react5.25.7-snapshot.v20250403202028
@clerk/react-router1.2.1-snapshot.v20250403202028
@clerk/remix4.5.13-snapshot.v20250403202028
@clerk/shared3.3.1-snapshot.v20250403202028
@clerk/tanstack-react-start0.13.1-snapshot.v20250403202028
@clerk/testing1.4.35-snapshot.v20250403202028
@clerk/themes2.2.28-snapshot.v20250403202028
@clerk/types4.50.3-snapshot.v20250403202028
@clerk/vue1.4.7-snapshot.v20250403202028
Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit
npm i @clerk/agent-toolkit@0.0.18-snapshot.v20250403202028 --save-exact
@clerk/astro
npm i @clerk/astro@2.5.1-snapshot.v20250403202028 --save-exact
@clerk/backend
npm i @clerk/backend@1.26.1-snapshot.v20250403202028 --save-exact
@clerk/chrome-extension
npm i @clerk/chrome-extension@2.2.25-snapshot.v20250403202028 --save-exact
@clerk/clerk-js
npm i @clerk/clerk-js@5.59.1-snapshot.v20250403202028 --save-exact
@clerk/elements
npm i @clerk/elements@0.23.10-snapshot.v20250403202028 --save-exact
@clerk/clerk-expo
npm i @clerk/clerk-expo@2.9.8-snapshot.v20250403202028 --save-exact
@clerk/expo-passkeys
npm i @clerk/expo-passkeys@0.2.2-snapshot.v20250403202028 --save-exact
@clerk/express
npm i @clerk/express@1.4.1-snapshot.v20250403202028 --save-exact
@clerk/fastify
npm i @clerk/fastify@2.2.1-snapshot.v20250403202028 --save-exact
@clerk/localizations
npm i @clerk/localizations@3.13.6-snapshot.v20250403202028 --save-exact
@clerk/nextjs
npm i @clerk/nextjs@6.14.0-snapshot.v20250403202028 --save-exact
@clerk/nuxt
npm i @clerk/nuxt@1.5.1-snapshot.v20250403202028 --save-exact
@clerk/clerk-react
npm i @clerk/clerk-react@5.25.7-snapshot.v20250403202028 --save-exact
@clerk/react-router
npm i @clerk/react-router@1.2.1-snapshot.v20250403202028 --save-exact
@clerk/remix
npm i @clerk/remix@4.5.13-snapshot.v20250403202028 --save-exact
@clerk/shared
npm i @clerk/shared@3.3.1-snapshot.v20250403202028 --save-exact
@clerk/tanstack-react-start
npm i @clerk/tanstack-react-start@0.13.1-snapshot.v20250403202028 --save-exact
@clerk/testing
npm i @clerk/testing@1.4.35-snapshot.v20250403202028 --save-exact
@clerk/themes
npm i @clerk/themes@2.2.28-snapshot.v20250403202028 --save-exact
@clerk/types
npm i @clerk/types@4.50.3-snapshot.v20250403202028 --save-exact
@clerk/vue
npm i @clerk/vue@1.4.7-snapshot.v20250403202028 --save-exact
nikosdouvlis
nikosdouvlis
approved these changes
Apr 4, 2025
View reviewed changes
Comment threadpackages/nextjs/src/server/clerkMiddleware.ts
Outdated

 // and move the logic in clerk/backend
 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
 if (key === 'Content-Security-Policy') {
@nikosdouvlisnikosdouvlisApr 4, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: we can replace this string this with the constants import from @clerk/backend
brkalow
brkalow
reviewed
Apr 4, 2025
View reviewed changes
Comment thread.changeset/vast-clubs-speak.md
Outdated

brkalow
brkalow
approved these changes
Apr 4, 2025
View reviewed changes
@brkalowbrkalow
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👏
@jacekradko
jacekradko
merged commit 2cceeba
into
mainApr 4, 2025
@jacekradko
jacekradko
deleted the

feat/nextjs-inject-csp-in-middleware

branch
April 4, 2025 20:25
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 4, 2025
 Merged

@jacekradkojacekradko
mentioned this pull request
Apr 7, 2025
 Merged

2 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jescalanjescalanjescalan left review comments
Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@brkalowbrkalowbrkalow approved these changes
@nikosdouvlisnikosdouvlisnikosdouvlis approved these changes

+1 more reviewer

@panteliselefpanteliselefpanteliselef left review comments
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backendfastifynextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

7 participants

@jacekradko@clerk-cookie@jescalan@brkalow@nikosdouvlis@panteliselef

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(nextjs): Add CSP in middleware - #5493
Merged
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Apr 4, 2025
Merged
feat(nextjs): Add CSP in middleware#5493
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Conversation
@jacekradko
@jacekradkojacekradko
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Adding the ability to automatically inject the CSP header through @clerk/nextjs middleware.
You can now configure clerkMiddleware with an optional param contentSecurityPolicy like the following example:
exportdefaultclerkMiddleware(async(auth,request)=>{if(!isPublicRoute(request)){awaitauth.protect();}},{debug: process.env.NODE_ENV!=="production",contentSecurityPolicy: {mode: "strict-dynamic",directives: {"connect-src": ["sub.domain.com"],}}});
Closes: SDKI-913
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d822452
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendMinor
@clerk/nextjsMinor
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/remixPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
NameStatusPreviewCommentsUpdated (UTC)
clerk-js-sandbox⬜️ Skipped (Inspect)Apr 4, 2025 7:35pm
@jacekradko
jacekradko
requested review from
a team and CopilotMarch 31, 2025 16:41
CopilotAI
reviewed
Mar 31, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR introduces a new CSP header utility to automatically inject a Clerk‐compatible Content Security Policy header, including support for nonce generation in strict-dynamic mode.
  • Adds a new file (content-security-policy.ts) with functions to create, merge, and format CSP headers.
  • Updates clerkMiddleware.ts to integrate the CSP header injection into the middleware flow and adjusts ClerkProvider.tsx to use a dedicated nonce header.
  • Enhances test coverage by adding comprehensive tests for the new CSP functionality.
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
FileDescription
packages/nextjs/src/server/content-security-policy.tsIntroduces CSP header creation and processing functions, including nonce support.
packages/nextjs/src/server/clerkMiddleware.tsIntegrates CSP header injection into the middleware and logs CSP details in debug mode.
packages/nextjs/src/server/tests/content-security-policy.test.tsProvides extensive tests for various CSP header scenarios and edge cases.
packages/nextjs/src/app-router/server/ClerkProvider.tsxAdjusts nonce extraction by adding support for a dedicated X-Nonce header.
.changeset/vast-clubs-speak.mdUpdates the changelog to record the addition of Clerk-compatible CSP header support.
Comments suppressed due to low confidence (2)
packages/nextjs/src/server/content-security-policy.ts:200
  • [nitpick] Consider pre-formatting the directive values into an array once before sorting to avoid redundant calls to CSPDirectiveManager.formatValue; this could improve performance and ensure consistent ordering.
const sortedValues = Array.from(values).sort((a, b) => {

packages/nextjs/src/server/clerkMiddleware.ts:196
  • [nitpick] Ensure that the CSP header injection logic properly validates and sanitizes input values (both the host and any existing CSP header) to avoid potential header conflicts or injection issues, especially as the feature evolves.
if (options.injectCSP) {

@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradkoforce-pushed
the
feat/nextjs-inject-csp-in-middleware
branch
from
c5b6e27 to
76e237bCompareApril 1, 2025 14:30
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradko
commented
Apr 3, 2025

Copy link


Copy Markdown

ContributorAuthor
!snapshot
@clerk-cookie
clerk-cookie
commented
Apr 3, 2025

Copy link


Copy Markdown

Collaborator
Hey @jacekradko - the snapshot version command generated the following package versions:
PackageVersion
@clerk/agent-toolkit0.0.18-snapshot.v20250403202028
@clerk/astro2.5.1-snapshot.v20250403202028
@clerk/backend1.26.1-snapshot.v20250403202028
@clerk/chrome-extension2.2.25-snapshot.v20250403202028
@clerk/clerk-js5.59.1-snapshot.v20250403202028
@clerk/elements0.23.10-snapshot.v20250403202028
@clerk/clerk-expo2.9.8-snapshot.v20250403202028
@clerk/expo-passkeys0.2.2-snapshot.v20250403202028
@clerk/express1.4.1-snapshot.v20250403202028
@clerk/fastify2.2.1-snapshot.v20250403202028
@clerk/localizations3.13.6-snapshot.v20250403202028
@clerk/nextjs6.14.0-snapshot.v20250403202028
@clerk/nuxt1.5.1-snapshot.v20250403202028
@clerk/clerk-react5.25.7-snapshot.v20250403202028
@clerk/react-router1.2.1-snapshot.v20250403202028
@clerk/remix4.5.13-snapshot.v20250403202028
@clerk/shared3.3.1-snapshot.v20250403202028
@clerk/tanstack-react-start0.13.1-snapshot.v20250403202028
@clerk/testing1.4.35-snapshot.v20250403202028
@clerk/themes2.2.28-snapshot.v20250403202028
@clerk/types4.50.3-snapshot.v20250403202028
@clerk/vue1.4.7-snapshot.v20250403202028
Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit
npm i @clerk/agent-toolkit@0.0.18-snapshot.v20250403202028 --save-exact
@clerk/astro
npm i @clerk/astro@2.5.1-snapshot.v20250403202028 --save-exact
@clerk/backend
npm i @clerk/backend@1.26.1-snapshot.v20250403202028 --save-exact
@clerk/chrome-extension
npm i @clerk/chrome-extension@2.2.25-snapshot.v20250403202028 --save-exact
@clerk/clerk-js
npm i @clerk/clerk-js@5.59.1-snapshot.v20250403202028 --save-exact
@clerk/elements
npm i @clerk/elements@0.23.10-snapshot.v20250403202028 --save-exact
@clerk/clerk-expo
npm i @clerk/clerk-expo@2.9.8-snapshot.v20250403202028 --save-exact
@clerk/expo-passkeys
npm i @clerk/expo-passkeys@0.2.2-snapshot.v20250403202028 --save-exact
@clerk/express
npm i @clerk/express@1.4.1-snapshot.v20250403202028 --save-exact
@clerk/fastify
npm i @clerk/fastify@2.2.1-snapshot.v20250403202028 --save-exact
@clerk/localizations
npm i @clerk/localizations@3.13.6-snapshot.v20250403202028 --save-exact
@clerk/nextjs
npm i @clerk/nextjs@6.14.0-snapshot.v20250403202028 --save-exact
@clerk/nuxt
npm i @clerk/nuxt@1.5.1-snapshot.v20250403202028 --save-exact
@clerk/clerk-react
npm i @clerk/clerk-react@5.25.7-snapshot.v20250403202028 --save-exact
@clerk/react-router
npm i @clerk/react-router@1.2.1-snapshot.v20250403202028 --save-exact
@clerk/remix
npm i @clerk/remix@4.5.13-snapshot.v20250403202028 --save-exact
@clerk/shared
npm i @clerk/shared@3.3.1-snapshot.v20250403202028 --save-exact
@clerk/tanstack-react-start
npm i @clerk/tanstack-react-start@0.13.1-snapshot.v20250403202028 --save-exact
@clerk/testing
npm i @clerk/testing@1.4.35-snapshot.v20250403202028 --save-exact
@clerk/themes
npm i @clerk/themes@2.2.28-snapshot.v20250403202028 --save-exact
@clerk/types
npm i @clerk/types@4.50.3-snapshot.v20250403202028 --save-exact
@clerk/vue
npm i @clerk/vue@1.4.7-snapshot.v20250403202028 --save-exact
nikosdouvlis
nikosdouvlis
approved these changes
Apr 4, 2025
View reviewed changes
Comment threadpackages/nextjs/src/server/clerkMiddleware.ts
Outdated

 // and move the logic in clerk/backend
 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
 if (key === 'Content-Security-Policy') {
@nikosdouvlisnikosdouvlisApr 4, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: we can replace this string this with the constants import from @clerk/backend
brkalow
brkalow
reviewed
Apr 4, 2025
View reviewed changes
Comment thread.changeset/vast-clubs-speak.md
Outdated

brkalow
brkalow
approved these changes
Apr 4, 2025
View reviewed changes
@brkalowbrkalow
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👏
@jacekradko
jacekradko
merged commit 2cceeba
into
mainApr 4, 2025
@jacekradko
jacekradko
deleted the

feat/nextjs-inject-csp-in-middleware

branch
April 4, 2025 20:25
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 4, 2025
 Merged

@jacekradkojacekradko
mentioned this pull request
Apr 7, 2025
 Merged

2 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jescalanjescalanjescalan left review comments
Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@brkalowbrkalowbrkalow approved these changes
@nikosdouvlisnikosdouvlisnikosdouvlis approved these changes

+1 more reviewer

@panteliselefpanteliselefpanteliselef left review comments
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backendfastifynextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

7 participants

@jacekradko@clerk-cookie@jescalan@brkalow@nikosdouvlis@panteliselef

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(nextjs): Add CSP in middleware - #5493
Merged
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Apr 4, 2025
Merged
feat(nextjs): Add CSP in middleware#5493
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Conversation
@jacekradko
@jacekradkojacekradko
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Adding the ability to automatically inject the CSP header through @clerk/nextjs middleware.
You can now configure clerkMiddleware with an optional param contentSecurityPolicy like the following example:
exportdefaultclerkMiddleware(async(auth,request)=>{if(!isPublicRoute(request)){awaitauth.protect();}},{debug: process.env.NODE_ENV!=="production",contentSecurityPolicy: {mode: "strict-dynamic",directives: {"connect-src": ["sub.domain.com"],}}});
Closes: SDKI-913
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d822452
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendMinor
@clerk/nextjsMinor
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/remixPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
NameStatusPreviewCommentsUpdated (UTC)
clerk-js-sandbox⬜️ Skipped (Inspect)Apr 4, 2025 7:35pm
@jacekradko
jacekradko
requested review from
a team and CopilotMarch 31, 2025 16:41
CopilotAI
reviewed
Mar 31, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR introduces a new CSP header utility to automatically inject a Clerk‐compatible Content Security Policy header, including support for nonce generation in strict-dynamic mode.
  • Adds a new file (content-security-policy.ts) with functions to create, merge, and format CSP headers.
  • Updates clerkMiddleware.ts to integrate the CSP header injection into the middleware flow and adjusts ClerkProvider.tsx to use a dedicated nonce header.
  • Enhances test coverage by adding comprehensive tests for the new CSP functionality.
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
FileDescription
packages/nextjs/src/server/content-security-policy.tsIntroduces CSP header creation and processing functions, including nonce support.
packages/nextjs/src/server/clerkMiddleware.tsIntegrates CSP header injection into the middleware and logs CSP details in debug mode.
packages/nextjs/src/server/tests/content-security-policy.test.tsProvides extensive tests for various CSP header scenarios and edge cases.
packages/nextjs/src/app-router/server/ClerkProvider.tsxAdjusts nonce extraction by adding support for a dedicated X-Nonce header.
.changeset/vast-clubs-speak.mdUpdates the changelog to record the addition of Clerk-compatible CSP header support.
Comments suppressed due to low confidence (2)
packages/nextjs/src/server/content-security-policy.ts:200
  • [nitpick] Consider pre-formatting the directive values into an array once before sorting to avoid redundant calls to CSPDirectiveManager.formatValue; this could improve performance and ensure consistent ordering.
const sortedValues = Array.from(values).sort((a, b) => {

packages/nextjs/src/server/clerkMiddleware.ts:196
  • [nitpick] Ensure that the CSP header injection logic properly validates and sanitizes input values (both the host and any existing CSP header) to avoid potential header conflicts or injection issues, especially as the feature evolves.
if (options.injectCSP) {

@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradkoforce-pushed
the
feat/nextjs-inject-csp-in-middleware
branch
from
c5b6e27 to
76e237bCompareApril 1, 2025 14:30
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradko
commented
Apr 3, 2025

Copy link


Copy Markdown

ContributorAuthor
!snapshot
@clerk-cookie
clerk-cookie
commented
Apr 3, 2025

Copy link


Copy Markdown

Collaborator
Hey @jacekradko - the snapshot version command generated the following package versions:
PackageVersion
@clerk/agent-toolkit0.0.18-snapshot.v20250403202028
@clerk/astro2.5.1-snapshot.v20250403202028
@clerk/backend1.26.1-snapshot.v20250403202028
@clerk/chrome-extension2.2.25-snapshot.v20250403202028
@clerk/clerk-js5.59.1-snapshot.v20250403202028
@clerk/elements0.23.10-snapshot.v20250403202028
@clerk/clerk-expo2.9.8-snapshot.v20250403202028
@clerk/expo-passkeys0.2.2-snapshot.v20250403202028
@clerk/express1.4.1-snapshot.v20250403202028
@clerk/fastify2.2.1-snapshot.v20250403202028
@clerk/localizations3.13.6-snapshot.v20250403202028
@clerk/nextjs6.14.0-snapshot.v20250403202028
@clerk/nuxt1.5.1-snapshot.v20250403202028
@clerk/clerk-react5.25.7-snapshot.v20250403202028
@clerk/react-router1.2.1-snapshot.v20250403202028
@clerk/remix4.5.13-snapshot.v20250403202028
@clerk/shared3.3.1-snapshot.v20250403202028
@clerk/tanstack-react-start0.13.1-snapshot.v20250403202028
@clerk/testing1.4.35-snapshot.v20250403202028
@clerk/themes2.2.28-snapshot.v20250403202028
@clerk/types4.50.3-snapshot.v20250403202028
@clerk/vue1.4.7-snapshot.v20250403202028
Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit
npm i @clerk/agent-toolkit@0.0.18-snapshot.v20250403202028 --save-exact
@clerk/astro
npm i @clerk/astro@2.5.1-snapshot.v20250403202028 --save-exact
@clerk/backend
npm i @clerk/backend@1.26.1-snapshot.v20250403202028 --save-exact
@clerk/chrome-extension
npm i @clerk/chrome-extension@2.2.25-snapshot.v20250403202028 --save-exact
@clerk/clerk-js
npm i @clerk/clerk-js@5.59.1-snapshot.v20250403202028 --save-exact
@clerk/elements
npm i @clerk/elements@0.23.10-snapshot.v20250403202028 --save-exact
@clerk/clerk-expo
npm i @clerk/clerk-expo@2.9.8-snapshot.v20250403202028 --save-exact
@clerk/expo-passkeys
npm i @clerk/expo-passkeys@0.2.2-snapshot.v20250403202028 --save-exact
@clerk/express
npm i @clerk/express@1.4.1-snapshot.v20250403202028 --save-exact
@clerk/fastify
npm i @clerk/fastify@2.2.1-snapshot.v20250403202028 --save-exact
@clerk/localizations
npm i @clerk/localizations@3.13.6-snapshot.v20250403202028 --save-exact
@clerk/nextjs
npm i @clerk/nextjs@6.14.0-snapshot.v20250403202028 --save-exact
@clerk/nuxt
npm i @clerk/nuxt@1.5.1-snapshot.v20250403202028 --save-exact
@clerk/clerk-react
npm i @clerk/clerk-react@5.25.7-snapshot.v20250403202028 --save-exact
@clerk/react-router
npm i @clerk/react-router@1.2.1-snapshot.v20250403202028 --save-exact
@clerk/remix
npm i @clerk/remix@4.5.13-snapshot.v20250403202028 --save-exact
@clerk/shared
npm i @clerk/shared@3.3.1-snapshot.v20250403202028 --save-exact
@clerk/tanstack-react-start
npm i @clerk/tanstack-react-start@0.13.1-snapshot.v20250403202028 --save-exact
@clerk/testing
npm i @clerk/testing@1.4.35-snapshot.v20250403202028 --save-exact
@clerk/themes
npm i @clerk/themes@2.2.28-snapshot.v20250403202028 --save-exact
@clerk/types
npm i @clerk/types@4.50.3-snapshot.v20250403202028 --save-exact
@clerk/vue
npm i @clerk/vue@1.4.7-snapshot.v20250403202028 --save-exact
nikosdouvlis
nikosdouvlis
approved these changes
Apr 4, 2025
View reviewed changes
Comment threadpackages/nextjs/src/server/clerkMiddleware.ts
Outdated

 // and move the logic in clerk/backend
 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
 if (key === 'Content-Security-Policy') {
@nikosdouvlisnikosdouvlisApr 4, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: we can replace this string this with the constants import from @clerk/backend
brkalow
brkalow
reviewed
Apr 4, 2025
View reviewed changes
Comment thread.changeset/vast-clubs-speak.md
Outdated

brkalow
brkalow
approved these changes
Apr 4, 2025
View reviewed changes
@brkalowbrkalow
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👏
@jacekradko
jacekradko
merged commit 2cceeba
into
mainApr 4, 2025
@jacekradko
jacekradko
deleted the

feat/nextjs-inject-csp-in-middleware

branch
April 4, 2025 20:25
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 4, 2025
 Merged

@jacekradkojacekradko
mentioned this pull request
Apr 7, 2025
 Merged

2 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jescalanjescalanjescalan left review comments
Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@brkalowbrkalowbrkalow approved these changes
@nikosdouvlisnikosdouvlisnikosdouvlis approved these changes

+1 more reviewer

@panteliselefpanteliselefpanteliselef left review comments
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backendfastifynextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

7 participants

@jacekradko@clerk-cookie@jescalan@brkalow@nikosdouvlis@panteliselef

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(nextjs): Add CSP in middleware - #5493
Merged
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Apr 4, 2025
Merged
feat(nextjs): Add CSP in middleware#5493
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Conversation
@jacekradko
@jacekradkojacekradko
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Adding the ability to automatically inject the CSP header through @clerk/nextjs middleware.
You can now configure clerkMiddleware with an optional param contentSecurityPolicy like the following example:
exportdefaultclerkMiddleware(async(auth,request)=>{if(!isPublicRoute(request)){awaitauth.protect();}},{debug: process.env.NODE_ENV!=="production",contentSecurityPolicy: {mode: "strict-dynamic",directives: {"connect-src": ["sub.domain.com"],}}});
Closes: SDKI-913
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d822452
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendMinor
@clerk/nextjsMinor
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/remixPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
NameStatusPreviewCommentsUpdated (UTC)
clerk-js-sandbox⬜️ Skipped (Inspect)Apr 4, 2025 7:35pm
@jacekradko
jacekradko
requested review from
a team and CopilotMarch 31, 2025 16:41
CopilotAI
reviewed
Mar 31, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR introduces a new CSP header utility to automatically inject a Clerk‐compatible Content Security Policy header, including support for nonce generation in strict-dynamic mode.
  • Adds a new file (content-security-policy.ts) with functions to create, merge, and format CSP headers.
  • Updates clerkMiddleware.ts to integrate the CSP header injection into the middleware flow and adjusts ClerkProvider.tsx to use a dedicated nonce header.
  • Enhances test coverage by adding comprehensive tests for the new CSP functionality.
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
FileDescription
packages/nextjs/src/server/content-security-policy.tsIntroduces CSP header creation and processing functions, including nonce support.
packages/nextjs/src/server/clerkMiddleware.tsIntegrates CSP header injection into the middleware and logs CSP details in debug mode.
packages/nextjs/src/server/tests/content-security-policy.test.tsProvides extensive tests for various CSP header scenarios and edge cases.
packages/nextjs/src/app-router/server/ClerkProvider.tsxAdjusts nonce extraction by adding support for a dedicated X-Nonce header.
.changeset/vast-clubs-speak.mdUpdates the changelog to record the addition of Clerk-compatible CSP header support.
Comments suppressed due to low confidence (2)
packages/nextjs/src/server/content-security-policy.ts:200
  • [nitpick] Consider pre-formatting the directive values into an array once before sorting to avoid redundant calls to CSPDirectiveManager.formatValue; this could improve performance and ensure consistent ordering.
const sortedValues = Array.from(values).sort((a, b) => {

packages/nextjs/src/server/clerkMiddleware.ts:196
  • [nitpick] Ensure that the CSP header injection logic properly validates and sanitizes input values (both the host and any existing CSP header) to avoid potential header conflicts or injection issues, especially as the feature evolves.
if (options.injectCSP) {

@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradkoforce-pushed
the
feat/nextjs-inject-csp-in-middleware
branch
from
c5b6e27 to
76e237bCompareApril 1, 2025 14:30
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradko
commented
Apr 3, 2025

Copy link


Copy Markdown

ContributorAuthor
!snapshot
@clerk-cookie
clerk-cookie
commented
Apr 3, 2025

Copy link


Copy Markdown

Collaborator
Hey @jacekradko - the snapshot version command generated the following package versions:
PackageVersion
@clerk/agent-toolkit0.0.18-snapshot.v20250403202028
@clerk/astro2.5.1-snapshot.v20250403202028
@clerk/backend1.26.1-snapshot.v20250403202028
@clerk/chrome-extension2.2.25-snapshot.v20250403202028
@clerk/clerk-js5.59.1-snapshot.v20250403202028
@clerk/elements0.23.10-snapshot.v20250403202028
@clerk/clerk-expo2.9.8-snapshot.v20250403202028
@clerk/expo-passkeys0.2.2-snapshot.v20250403202028
@clerk/express1.4.1-snapshot.v20250403202028
@clerk/fastify2.2.1-snapshot.v20250403202028
@clerk/localizations3.13.6-snapshot.v20250403202028
@clerk/nextjs6.14.0-snapshot.v20250403202028
@clerk/nuxt1.5.1-snapshot.v20250403202028
@clerk/clerk-react5.25.7-snapshot.v20250403202028
@clerk/react-router1.2.1-snapshot.v20250403202028
@clerk/remix4.5.13-snapshot.v20250403202028
@clerk/shared3.3.1-snapshot.v20250403202028
@clerk/tanstack-react-start0.13.1-snapshot.v20250403202028
@clerk/testing1.4.35-snapshot.v20250403202028
@clerk/themes2.2.28-snapshot.v20250403202028
@clerk/types4.50.3-snapshot.v20250403202028
@clerk/vue1.4.7-snapshot.v20250403202028
Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit
npm i @clerk/agent-toolkit@0.0.18-snapshot.v20250403202028 --save-exact
@clerk/astro
npm i @clerk/astro@2.5.1-snapshot.v20250403202028 --save-exact
@clerk/backend
npm i @clerk/backend@1.26.1-snapshot.v20250403202028 --save-exact
@clerk/chrome-extension
npm i @clerk/chrome-extension@2.2.25-snapshot.v20250403202028 --save-exact
@clerk/clerk-js
npm i @clerk/clerk-js@5.59.1-snapshot.v20250403202028 --save-exact
@clerk/elements
npm i @clerk/elements@0.23.10-snapshot.v20250403202028 --save-exact
@clerk/clerk-expo
npm i @clerk/clerk-expo@2.9.8-snapshot.v20250403202028 --save-exact
@clerk/expo-passkeys
npm i @clerk/expo-passkeys@0.2.2-snapshot.v20250403202028 --save-exact
@clerk/express
npm i @clerk/express@1.4.1-snapshot.v20250403202028 --save-exact
@clerk/fastify
npm i @clerk/fastify@2.2.1-snapshot.v20250403202028 --save-exact
@clerk/localizations
npm i @clerk/localizations@3.13.6-snapshot.v20250403202028 --save-exact
@clerk/nextjs
npm i @clerk/nextjs@6.14.0-snapshot.v20250403202028 --save-exact
@clerk/nuxt
npm i @clerk/nuxt@1.5.1-snapshot.v20250403202028 --save-exact
@clerk/clerk-react
npm i @clerk/clerk-react@5.25.7-snapshot.v20250403202028 --save-exact
@clerk/react-router
npm i @clerk/react-router@1.2.1-snapshot.v20250403202028 --save-exact
@clerk/remix
npm i @clerk/remix@4.5.13-snapshot.v20250403202028 --save-exact
@clerk/shared
npm i @clerk/shared@3.3.1-snapshot.v20250403202028 --save-exact
@clerk/tanstack-react-start
npm i @clerk/tanstack-react-start@0.13.1-snapshot.v20250403202028 --save-exact
@clerk/testing
npm i @clerk/testing@1.4.35-snapshot.v20250403202028 --save-exact
@clerk/themes
npm i @clerk/themes@2.2.28-snapshot.v20250403202028 --save-exact
@clerk/types
npm i @clerk/types@4.50.3-snapshot.v20250403202028 --save-exact
@clerk/vue
npm i @clerk/vue@1.4.7-snapshot.v20250403202028 --save-exact
nikosdouvlis
nikosdouvlis
approved these changes
Apr 4, 2025
View reviewed changes
Comment threadpackages/nextjs/src/server/clerkMiddleware.ts
Outdated

 // and move the logic in clerk/backend
 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
 if (key === 'Content-Security-Policy') {
@nikosdouvlisnikosdouvlisApr 4, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: we can replace this string this with the constants import from @clerk/backend
brkalow
brkalow
reviewed
Apr 4, 2025
View reviewed changes
Comment thread.changeset/vast-clubs-speak.md
Outdated

brkalow
brkalow
approved these changes
Apr 4, 2025
View reviewed changes
@brkalowbrkalow
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👏
@jacekradko
jacekradko
merged commit 2cceeba
into
mainApr 4, 2025
@jacekradko
jacekradko
deleted the

feat/nextjs-inject-csp-in-middleware

branch
April 4, 2025 20:25
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 4, 2025
 Merged

@jacekradkojacekradko
mentioned this pull request
Apr 7, 2025
 Merged

2 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jescalanjescalanjescalan left review comments
Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@brkalowbrkalowbrkalow approved these changes
@nikosdouvlisnikosdouvlisnikosdouvlis approved these changes

+1 more reviewer

@panteliselefpanteliselefpanteliselef left review comments
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backendfastifynextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

7 participants

@jacekradko@clerk-cookie@jescalan@brkalow@nikosdouvlis@panteliselef

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(nextjs): Add CSP in middleware - #5493
Merged
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Apr 4, 2025
Merged
feat(nextjs): Add CSP in middleware#5493
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Conversation
@jacekradko
@jacekradkojacekradko
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Adding the ability to automatically inject the CSP header through @clerk/nextjs middleware.
You can now configure clerkMiddleware with an optional param contentSecurityPolicy like the following example:
exportdefaultclerkMiddleware(async(auth,request)=>{if(!isPublicRoute(request)){awaitauth.protect();}},{debug: process.env.NODE_ENV!=="production",contentSecurityPolicy: {mode: "strict-dynamic",directives: {"connect-src": ["sub.domain.com"],}}});
Closes: SDKI-913
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d822452
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendMinor
@clerk/nextjsMinor
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/remixPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
NameStatusPreviewCommentsUpdated (UTC)
clerk-js-sandbox⬜️ Skipped (Inspect)Apr 4, 2025 7:35pm
@jacekradko
jacekradko
requested review from
a team and CopilotMarch 31, 2025 16:41
CopilotAI
reviewed
Mar 31, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR introduces a new CSP header utility to automatically inject a Clerk‐compatible Content Security Policy header, including support for nonce generation in strict-dynamic mode.
  • Adds a new file (content-security-policy.ts) with functions to create, merge, and format CSP headers.
  • Updates clerkMiddleware.ts to integrate the CSP header injection into the middleware flow and adjusts ClerkProvider.tsx to use a dedicated nonce header.
  • Enhances test coverage by adding comprehensive tests for the new CSP functionality.
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
FileDescription
packages/nextjs/src/server/content-security-policy.tsIntroduces CSP header creation and processing functions, including nonce support.
packages/nextjs/src/server/clerkMiddleware.tsIntegrates CSP header injection into the middleware and logs CSP details in debug mode.
packages/nextjs/src/server/tests/content-security-policy.test.tsProvides extensive tests for various CSP header scenarios and edge cases.
packages/nextjs/src/app-router/server/ClerkProvider.tsxAdjusts nonce extraction by adding support for a dedicated X-Nonce header.
.changeset/vast-clubs-speak.mdUpdates the changelog to record the addition of Clerk-compatible CSP header support.
Comments suppressed due to low confidence (2)
packages/nextjs/src/server/content-security-policy.ts:200
  • [nitpick] Consider pre-formatting the directive values into an array once before sorting to avoid redundant calls to CSPDirectiveManager.formatValue; this could improve performance and ensure consistent ordering.
const sortedValues = Array.from(values).sort((a, b) => {

packages/nextjs/src/server/clerkMiddleware.ts:196
  • [nitpick] Ensure that the CSP header injection logic properly validates and sanitizes input values (both the host and any existing CSP header) to avoid potential header conflicts or injection issues, especially as the feature evolves.
if (options.injectCSP) {

@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradkoforce-pushed
the
feat/nextjs-inject-csp-in-middleware
branch
from
c5b6e27 to
76e237bCompareApril 1, 2025 14:30
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradko
commented
Apr 3, 2025

Copy link


Copy Markdown

ContributorAuthor
!snapshot
@clerk-cookie
clerk-cookie
commented
Apr 3, 2025

Copy link


Copy Markdown

Collaborator
Hey @jacekradko - the snapshot version command generated the following package versions:
PackageVersion
@clerk/agent-toolkit0.0.18-snapshot.v20250403202028
@clerk/astro2.5.1-snapshot.v20250403202028
@clerk/backend1.26.1-snapshot.v20250403202028
@clerk/chrome-extension2.2.25-snapshot.v20250403202028
@clerk/clerk-js5.59.1-snapshot.v20250403202028
@clerk/elements0.23.10-snapshot.v20250403202028
@clerk/clerk-expo2.9.8-snapshot.v20250403202028
@clerk/expo-passkeys0.2.2-snapshot.v20250403202028
@clerk/express1.4.1-snapshot.v20250403202028
@clerk/fastify2.2.1-snapshot.v20250403202028
@clerk/localizations3.13.6-snapshot.v20250403202028
@clerk/nextjs6.14.0-snapshot.v20250403202028
@clerk/nuxt1.5.1-snapshot.v20250403202028
@clerk/clerk-react5.25.7-snapshot.v20250403202028
@clerk/react-router1.2.1-snapshot.v20250403202028
@clerk/remix4.5.13-snapshot.v20250403202028
@clerk/shared3.3.1-snapshot.v20250403202028
@clerk/tanstack-react-start0.13.1-snapshot.v20250403202028
@clerk/testing1.4.35-snapshot.v20250403202028
@clerk/themes2.2.28-snapshot.v20250403202028
@clerk/types4.50.3-snapshot.v20250403202028
@clerk/vue1.4.7-snapshot.v20250403202028
Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit
npm i @clerk/agent-toolkit@0.0.18-snapshot.v20250403202028 --save-exact
@clerk/astro
npm i @clerk/astro@2.5.1-snapshot.v20250403202028 --save-exact
@clerk/backend
npm i @clerk/backend@1.26.1-snapshot.v20250403202028 --save-exact
@clerk/chrome-extension
npm i @clerk/chrome-extension@2.2.25-snapshot.v20250403202028 --save-exact
@clerk/clerk-js
npm i @clerk/clerk-js@5.59.1-snapshot.v20250403202028 --save-exact
@clerk/elements
npm i @clerk/elements@0.23.10-snapshot.v20250403202028 --save-exact
@clerk/clerk-expo
npm i @clerk/clerk-expo@2.9.8-snapshot.v20250403202028 --save-exact
@clerk/expo-passkeys
npm i @clerk/expo-passkeys@0.2.2-snapshot.v20250403202028 --save-exact
@clerk/express
npm i @clerk/express@1.4.1-snapshot.v20250403202028 --save-exact
@clerk/fastify
npm i @clerk/fastify@2.2.1-snapshot.v20250403202028 --save-exact
@clerk/localizations
npm i @clerk/localizations@3.13.6-snapshot.v20250403202028 --save-exact
@clerk/nextjs
npm i @clerk/nextjs@6.14.0-snapshot.v20250403202028 --save-exact
@clerk/nuxt
npm i @clerk/nuxt@1.5.1-snapshot.v20250403202028 --save-exact
@clerk/clerk-react
npm i @clerk/clerk-react@5.25.7-snapshot.v20250403202028 --save-exact
@clerk/react-router
npm i @clerk/react-router@1.2.1-snapshot.v20250403202028 --save-exact
@clerk/remix
npm i @clerk/remix@4.5.13-snapshot.v20250403202028 --save-exact
@clerk/shared
npm i @clerk/shared@3.3.1-snapshot.v20250403202028 --save-exact
@clerk/tanstack-react-start
npm i @clerk/tanstack-react-start@0.13.1-snapshot.v20250403202028 --save-exact
@clerk/testing
npm i @clerk/testing@1.4.35-snapshot.v20250403202028 --save-exact
@clerk/themes
npm i @clerk/themes@2.2.28-snapshot.v20250403202028 --save-exact
@clerk/types
npm i @clerk/types@4.50.3-snapshot.v20250403202028 --save-exact
@clerk/vue
npm i @clerk/vue@1.4.7-snapshot.v20250403202028 --save-exact
nikosdouvlis
nikosdouvlis
approved these changes
Apr 4, 2025
View reviewed changes
Comment threadpackages/nextjs/src/server/clerkMiddleware.ts
Outdated

 // and move the logic in clerk/backend
 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
 if (key === 'Content-Security-Policy') {
@nikosdouvlisnikosdouvlisApr 4, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: we can replace this string this with the constants import from @clerk/backend
brkalow
brkalow
reviewed
Apr 4, 2025
View reviewed changes
Comment thread.changeset/vast-clubs-speak.md
Outdated

brkalow
brkalow
approved these changes
Apr 4, 2025
View reviewed changes
@brkalowbrkalow
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👏
@jacekradko
jacekradko
merged commit 2cceeba
into
mainApr 4, 2025
@jacekradko
jacekradko
deleted the

feat/nextjs-inject-csp-in-middleware

branch
April 4, 2025 20:25
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 4, 2025
 Merged

@jacekradkojacekradko
mentioned this pull request
Apr 7, 2025
 Merged

2 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jescalanjescalanjescalan left review comments
Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@brkalowbrkalowbrkalow approved these changes
@nikosdouvlisnikosdouvlisnikosdouvlis approved these changes

+1 more reviewer

@panteliselefpanteliselefpanteliselef left review comments
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backendfastifynextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

7 participants

@jacekradko@clerk-cookie@jescalan@brkalow@nikosdouvlis@panteliselef

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(nextjs): Add CSP in middleware - #5493
Merged
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Apr 4, 2025
Merged
feat(nextjs): Add CSP in middleware#5493
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Conversation
@jacekradko
@jacekradkojacekradko
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Adding the ability to automatically inject the CSP header through @clerk/nextjs middleware.
You can now configure clerkMiddleware with an optional param contentSecurityPolicy like the following example:
exportdefaultclerkMiddleware(async(auth,request)=>{if(!isPublicRoute(request)){awaitauth.protect();}},{debug: process.env.NODE_ENV!=="production",contentSecurityPolicy: {mode: "strict-dynamic",directives: {"connect-src": ["sub.domain.com"],}}});
Closes: SDKI-913
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d822452
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendMinor
@clerk/nextjsMinor
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/remixPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
NameStatusPreviewCommentsUpdated (UTC)
clerk-js-sandbox⬜️ Skipped (Inspect)Apr 4, 2025 7:35pm
@jacekradko
jacekradko
requested review from
a team and CopilotMarch 31, 2025 16:41
CopilotAI
reviewed
Mar 31, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR introduces a new CSP header utility to automatically inject a Clerk‐compatible Content Security Policy header, including support for nonce generation in strict-dynamic mode.
  • Adds a new file (content-security-policy.ts) with functions to create, merge, and format CSP headers.
  • Updates clerkMiddleware.ts to integrate the CSP header injection into the middleware flow and adjusts ClerkProvider.tsx to use a dedicated nonce header.
  • Enhances test coverage by adding comprehensive tests for the new CSP functionality.
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
FileDescription
packages/nextjs/src/server/content-security-policy.tsIntroduces CSP header creation and processing functions, including nonce support.
packages/nextjs/src/server/clerkMiddleware.tsIntegrates CSP header injection into the middleware and logs CSP details in debug mode.
packages/nextjs/src/server/tests/content-security-policy.test.tsProvides extensive tests for various CSP header scenarios and edge cases.
packages/nextjs/src/app-router/server/ClerkProvider.tsxAdjusts nonce extraction by adding support for a dedicated X-Nonce header.
.changeset/vast-clubs-speak.mdUpdates the changelog to record the addition of Clerk-compatible CSP header support.
Comments suppressed due to low confidence (2)
packages/nextjs/src/server/content-security-policy.ts:200
  • [nitpick] Consider pre-formatting the directive values into an array once before sorting to avoid redundant calls to CSPDirectiveManager.formatValue; this could improve performance and ensure consistent ordering.
const sortedValues = Array.from(values).sort((a, b) => {

packages/nextjs/src/server/clerkMiddleware.ts:196
  • [nitpick] Ensure that the CSP header injection logic properly validates and sanitizes input values (both the host and any existing CSP header) to avoid potential header conflicts or injection issues, especially as the feature evolves.
if (options.injectCSP) {

@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradkoforce-pushed
the
feat/nextjs-inject-csp-in-middleware
branch
from
c5b6e27 to
76e237bCompareApril 1, 2025 14:30
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradko
commented
Apr 3, 2025

Copy link


Copy Markdown

ContributorAuthor
!snapshot
@clerk-cookie
clerk-cookie
commented
Apr 3, 2025

Copy link


Copy Markdown

Collaborator
Hey @jacekradko - the snapshot version command generated the following package versions:
PackageVersion
@clerk/agent-toolkit0.0.18-snapshot.v20250403202028
@clerk/astro2.5.1-snapshot.v20250403202028
@clerk/backend1.26.1-snapshot.v20250403202028
@clerk/chrome-extension2.2.25-snapshot.v20250403202028
@clerk/clerk-js5.59.1-snapshot.v20250403202028
@clerk/elements0.23.10-snapshot.v20250403202028
@clerk/clerk-expo2.9.8-snapshot.v20250403202028
@clerk/expo-passkeys0.2.2-snapshot.v20250403202028
@clerk/express1.4.1-snapshot.v20250403202028
@clerk/fastify2.2.1-snapshot.v20250403202028
@clerk/localizations3.13.6-snapshot.v20250403202028
@clerk/nextjs6.14.0-snapshot.v20250403202028
@clerk/nuxt1.5.1-snapshot.v20250403202028
@clerk/clerk-react5.25.7-snapshot.v20250403202028
@clerk/react-router1.2.1-snapshot.v20250403202028
@clerk/remix4.5.13-snapshot.v20250403202028
@clerk/shared3.3.1-snapshot.v20250403202028
@clerk/tanstack-react-start0.13.1-snapshot.v20250403202028
@clerk/testing1.4.35-snapshot.v20250403202028
@clerk/themes2.2.28-snapshot.v20250403202028
@clerk/types4.50.3-snapshot.v20250403202028
@clerk/vue1.4.7-snapshot.v20250403202028
Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit
npm i @clerk/agent-toolkit@0.0.18-snapshot.v20250403202028 --save-exact
@clerk/astro
npm i @clerk/astro@2.5.1-snapshot.v20250403202028 --save-exact
@clerk/backend
npm i @clerk/backend@1.26.1-snapshot.v20250403202028 --save-exact
@clerk/chrome-extension
npm i @clerk/chrome-extension@2.2.25-snapshot.v20250403202028 --save-exact
@clerk/clerk-js
npm i @clerk/clerk-js@5.59.1-snapshot.v20250403202028 --save-exact
@clerk/elements
npm i @clerk/elements@0.23.10-snapshot.v20250403202028 --save-exact
@clerk/clerk-expo
npm i @clerk/clerk-expo@2.9.8-snapshot.v20250403202028 --save-exact
@clerk/expo-passkeys
npm i @clerk/expo-passkeys@0.2.2-snapshot.v20250403202028 --save-exact
@clerk/express
npm i @clerk/express@1.4.1-snapshot.v20250403202028 --save-exact
@clerk/fastify
npm i @clerk/fastify@2.2.1-snapshot.v20250403202028 --save-exact
@clerk/localizations
npm i @clerk/localizations@3.13.6-snapshot.v20250403202028 --save-exact
@clerk/nextjs
npm i @clerk/nextjs@6.14.0-snapshot.v20250403202028 --save-exact
@clerk/nuxt
npm i @clerk/nuxt@1.5.1-snapshot.v20250403202028 --save-exact
@clerk/clerk-react
npm i @clerk/clerk-react@5.25.7-snapshot.v20250403202028 --save-exact
@clerk/react-router
npm i @clerk/react-router@1.2.1-snapshot.v20250403202028 --save-exact
@clerk/remix
npm i @clerk/remix@4.5.13-snapshot.v20250403202028 --save-exact
@clerk/shared
npm i @clerk/shared@3.3.1-snapshot.v20250403202028 --save-exact
@clerk/tanstack-react-start
npm i @clerk/tanstack-react-start@0.13.1-snapshot.v20250403202028 --save-exact
@clerk/testing
npm i @clerk/testing@1.4.35-snapshot.v20250403202028 --save-exact
@clerk/themes
npm i @clerk/themes@2.2.28-snapshot.v20250403202028 --save-exact
@clerk/types
npm i @clerk/types@4.50.3-snapshot.v20250403202028 --save-exact
@clerk/vue
npm i @clerk/vue@1.4.7-snapshot.v20250403202028 --save-exact
nikosdouvlis
nikosdouvlis
approved these changes
Apr 4, 2025
View reviewed changes
Comment threadpackages/nextjs/src/server/clerkMiddleware.ts
Outdated

 // and move the logic in clerk/backend
 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
 if (key === 'Content-Security-Policy') {
@nikosdouvlisnikosdouvlisApr 4, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: we can replace this string this with the constants import from @clerk/backend
brkalow
brkalow
reviewed
Apr 4, 2025
View reviewed changes
Comment thread.changeset/vast-clubs-speak.md
Outdated

brkalow
brkalow
approved these changes
Apr 4, 2025
View reviewed changes
@brkalowbrkalow
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👏
@jacekradko
jacekradko
merged commit 2cceeba
into
mainApr 4, 2025
@jacekradko
jacekradko
deleted the

feat/nextjs-inject-csp-in-middleware

branch
April 4, 2025 20:25
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 4, 2025
 Merged

@jacekradkojacekradko
mentioned this pull request
Apr 7, 2025
 Merged

2 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jescalanjescalanjescalan left review comments
Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@brkalowbrkalowbrkalow approved these changes
@nikosdouvlisnikosdouvlisnikosdouvlis approved these changes

+1 more reviewer

@panteliselefpanteliselefpanteliselef left review comments
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backendfastifynextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

7 participants

@jacekradko@clerk-cookie@jescalan@brkalow@nikosdouvlis@panteliselef

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(nextjs): Add CSP in middleware - #5493
Merged
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Apr 4, 2025
Merged
feat(nextjs): Add CSP in middleware#5493
jacekradko merged 36 commits into
mainfrom 
feat/nextjs-inject-csp-in-middleware
Conversation
@jacekradko
@jacekradkojacekradko
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Description
Adding the ability to automatically inject the CSP header through @clerk/nextjs middleware.
You can now configure clerkMiddleware with an optional param contentSecurityPolicy like the following example:
exportdefaultclerkMiddleware(async(auth,request)=>{if(!isPublicRoute(request)){awaitauth.protect();}},{debug: process.env.NODE_ENV!=="production",contentSecurityPolicy: {mode: "strict-dynamic",directives: {"connect-src": ["sub.domain.com"],}}});
Closes: SDKI-913
Checklist
  • pnpm test runs as expected.
  • pnpm build runs as expected.
  •  (If applicable) JSDoc comments have been added or updated for any package exports
  •  (If applicable) Documentation has been updated
Type of change
  •  🐛 Bug fix
  •  🌟 New feature
  •  🔨 Breaking change
  •  📖 Refactoring / dependency upgrade / documentation
  •  other:
@changeset-bot
changeset-botBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: d822452
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendMinor
@clerk/nextjsMinor
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/remixPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@vercel
vercelBot
commented
Mar 31, 2025•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎
1 Skipped Deployment
NameStatusPreviewCommentsUpdated (UTC)
clerk-js-sandbox⬜️ Skipped (Inspect)Apr 4, 2025 7:35pm
@jacekradko
jacekradko
requested review from
a team and CopilotMarch 31, 2025 16:41
CopilotAI
reviewed
Mar 31, 2025
View reviewed changes
CopilotAI
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview
This PR introduces a new CSP header utility to automatically inject a Clerk‐compatible Content Security Policy header, including support for nonce generation in strict-dynamic mode.
  • Adds a new file (content-security-policy.ts) with functions to create, merge, and format CSP headers.
  • Updates clerkMiddleware.ts to integrate the CSP header injection into the middleware flow and adjusts ClerkProvider.tsx to use a dedicated nonce header.
  • Enhances test coverage by adding comprehensive tests for the new CSP functionality.
Reviewed Changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
FileDescription
packages/nextjs/src/server/content-security-policy.tsIntroduces CSP header creation and processing functions, including nonce support.
packages/nextjs/src/server/clerkMiddleware.tsIntegrates CSP header injection into the middleware and logs CSP details in debug mode.
packages/nextjs/src/server/tests/content-security-policy.test.tsProvides extensive tests for various CSP header scenarios and edge cases.
packages/nextjs/src/app-router/server/ClerkProvider.tsxAdjusts nonce extraction by adding support for a dedicated X-Nonce header.
.changeset/vast-clubs-speak.mdUpdates the changelog to record the addition of Clerk-compatible CSP header support.
Comments suppressed due to low confidence (2)
packages/nextjs/src/server/content-security-policy.ts:200
  • [nitpick] Consider pre-formatting the directive values into an array once before sorting to avoid redundant calls to CSPDirectiveManager.formatValue; this could improve performance and ensure consistent ordering.
const sortedValues = Array.from(values).sort((a, b) => {

packages/nextjs/src/server/clerkMiddleware.ts:196
  • [nitpick] Ensure that the CSP header injection logic properly validates and sanitizes input values (both the host and any existing CSP header) to avoid potential header conflicts or injection issues, especially as the feature evolves.
if (options.injectCSP) {

@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradkoforce-pushed
the
feat/nextjs-inject-csp-in-middleware
branch
from
c5b6e27 to
76e237bCompareApril 1, 2025 14:30
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko

This comment was marked as outdated.

Sign in to view
@clerk-cookie

This comment was marked as outdated.

Sign in to view
@jacekradko
jacekradko
commented
Apr 3, 2025

Copy link


Copy Markdown

ContributorAuthor
!snapshot
@clerk-cookie
clerk-cookie
commented
Apr 3, 2025

Copy link


Copy Markdown

Collaborator
Hey @jacekradko - the snapshot version command generated the following package versions:
PackageVersion
@clerk/agent-toolkit0.0.18-snapshot.v20250403202028
@clerk/astro2.5.1-snapshot.v20250403202028
@clerk/backend1.26.1-snapshot.v20250403202028
@clerk/chrome-extension2.2.25-snapshot.v20250403202028
@clerk/clerk-js5.59.1-snapshot.v20250403202028
@clerk/elements0.23.10-snapshot.v20250403202028
@clerk/clerk-expo2.9.8-snapshot.v20250403202028
@clerk/expo-passkeys0.2.2-snapshot.v20250403202028
@clerk/express1.4.1-snapshot.v20250403202028
@clerk/fastify2.2.1-snapshot.v20250403202028
@clerk/localizations3.13.6-snapshot.v20250403202028
@clerk/nextjs6.14.0-snapshot.v20250403202028
@clerk/nuxt1.5.1-snapshot.v20250403202028
@clerk/clerk-react5.25.7-snapshot.v20250403202028
@clerk/react-router1.2.1-snapshot.v20250403202028
@clerk/remix4.5.13-snapshot.v20250403202028
@clerk/shared3.3.1-snapshot.v20250403202028
@clerk/tanstack-react-start0.13.1-snapshot.v20250403202028
@clerk/testing1.4.35-snapshot.v20250403202028
@clerk/themes2.2.28-snapshot.v20250403202028
@clerk/types4.50.3-snapshot.v20250403202028
@clerk/vue1.4.7-snapshot.v20250403202028
Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit
npm i @clerk/agent-toolkit@0.0.18-snapshot.v20250403202028 --save-exact
@clerk/astro
npm i @clerk/astro@2.5.1-snapshot.v20250403202028 --save-exact
@clerk/backend
npm i @clerk/backend@1.26.1-snapshot.v20250403202028 --save-exact
@clerk/chrome-extension
npm i @clerk/chrome-extension@2.2.25-snapshot.v20250403202028 --save-exact
@clerk/clerk-js
npm i @clerk/clerk-js@5.59.1-snapshot.v20250403202028 --save-exact
@clerk/elements
npm i @clerk/elements@0.23.10-snapshot.v20250403202028 --save-exact
@clerk/clerk-expo
npm i @clerk/clerk-expo@2.9.8-snapshot.v20250403202028 --save-exact
@clerk/expo-passkeys
npm i @clerk/expo-passkeys@0.2.2-snapshot.v20250403202028 --save-exact
@clerk/express
npm i @clerk/express@1.4.1-snapshot.v20250403202028 --save-exact
@clerk/fastify
npm i @clerk/fastify@2.2.1-snapshot.v20250403202028 --save-exact
@clerk/localizations
npm i @clerk/localizations@3.13.6-snapshot.v20250403202028 --save-exact
@clerk/nextjs
npm i @clerk/nextjs@6.14.0-snapshot.v20250403202028 --save-exact
@clerk/nuxt
npm i @clerk/nuxt@1.5.1-snapshot.v20250403202028 --save-exact
@clerk/clerk-react
npm i @clerk/clerk-react@5.25.7-snapshot.v20250403202028 --save-exact
@clerk/react-router
npm i @clerk/react-router@1.2.1-snapshot.v20250403202028 --save-exact
@clerk/remix
npm i @clerk/remix@4.5.13-snapshot.v20250403202028 --save-exact
@clerk/shared
npm i @clerk/shared@3.3.1-snapshot.v20250403202028 --save-exact
@clerk/tanstack-react-start
npm i @clerk/tanstack-react-start@0.13.1-snapshot.v20250403202028 --save-exact
@clerk/testing
npm i @clerk/testing@1.4.35-snapshot.v20250403202028 --save-exact
@clerk/themes
npm i @clerk/themes@2.2.28-snapshot.v20250403202028 --save-exact
@clerk/types
npm i @clerk/types@4.50.3-snapshot.v20250403202028 --save-exact
@clerk/vue
npm i @clerk/vue@1.4.7-snapshot.v20250403202028 --save-exact
nikosdouvlis
nikosdouvlis
approved these changes
Apr 4, 2025
View reviewed changes
Comment threadpackages/nextjs/src/server/clerkMiddleware.ts
Outdated

 // and move the logic in clerk/backend
 if (requestState.headers) {
 requestState.headers.forEach((value, key) => {
 if (key === 'Content-Security-Policy') {
@nikosdouvlisnikosdouvlisApr 4, 2025

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: we can replace this string this with the constants import from @clerk/backend
brkalow
brkalow
reviewed
Apr 4, 2025
View reviewed changes
Comment thread.changeset/vast-clubs-speak.md
Outdated

brkalow
brkalow
approved these changes
Apr 4, 2025
View reviewed changes
@brkalowbrkalow
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👏
@jacekradko
jacekradko
merged commit 2cceeba
into
mainApr 4, 2025
@jacekradko
jacekradko
deleted the

feat/nextjs-inject-csp-in-middleware

branch
April 4, 2025 20:25
@clerk-cookieclerk-cookie
mentioned this pull request
Apr 4, 2025
 Merged

@jacekradkojacekradko
mentioned this pull request
Apr 7, 2025
 Merged

2 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@jescalanjescalanjescalan left review comments
Copilot code reviewCopilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@brkalowbrkalowbrkalow approved these changes
@nikosdouvlisnikosdouvlisnikosdouvlis approved these changes

+1 more reviewer

@panteliselefpanteliselefpanteliselef left review comments
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backendfastifynextjs

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

7 participants

@jacekradko@clerk-cookie@jescalan@brkalow@nikosdouvlis@panteliselef