Uh oh!
There was an error while loading. Please reload this page.
feat(backend): handle handshake nonce payload - #5865
Merged
Conversation
🦋 Changeset detectedLatest commit: b09f649 The changes in this PR will be included in the next version bump. This PR includes changesets to release 14 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
| describe('ClientAPI', () => { | ||
| const apiClient = createBackendApiClient({ | ||
| apiUrl: 'https://api.clerk.test', | ||
| secretKey: 'deadbeef', |
Check failure
Code scanning / CodeQL
Hard-coded credentials
jacekradko
marked this pull request as ready for review
May 8, 2025 23:23
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR implements a new handshake nonce flow on both the backend and client sides. Key changes include:
- Adding '__clerk_handshake_nonce' to recognized query params and URL cleanup.
- Updating the handshake token resolution logic to prioritize handshakeNonce and fetching handshakePayload directives.
- Replacing the legacy handshake payload schema and endpoints with the updated directives-based design.
Reviewed Changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| packages/clerk-js/src/utils/getClerkQueryParam.ts | Added the new '__clerk_handshake_nonce' parameter for client query handling. |
| packages/clerk-js/src/core/clerk.ts | Removed the handshake nonce parameter after URL cleanup. |
| packages/backend/src/tokens/request.ts | Updated request authentication to check for handshakeNonce as well as handshakeToken. |
| packages/backend/src/tokens/handshake.ts | Implemented handshake nonce logic by fetching payload directives using the nonce. |
| packages/backend/src/api/resources/HandshakePayload.ts | Updated payload structure from (nonce, payload) to directives array. |
| packages/backend/src/api/endpoints/ClientApi.ts | Added new client API endpoint for fetching handshake payload using nonce. |
| packages/backend/src/api/tests/ClientApi.test.ts | Added tests for the new handshake payload flow. |
| .changeset/eight-heads-act.md | Documented the changes affecting handshake nonce flow. |
Comments suppressed due to low confidence (1)
packages/backend/src/api/endpoints/HandshakePayloadApi.ts:1
- [nitpick] If this endpoint is no longer in use with the new handshake payload flow, consider removing the legacy HandshakePayloadApi file entirely to reduce code clutter.
import type { HandshakePayload } from '../resources/HandshakePayload';
Uh oh!
There was an error while loading. Please reload this page.
dstaley
approved these changes
May 9, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Implementing the handler for
__clerk_handshake_noncecookie.Changes
Backend token flow update: In HandshakeService, when a handshakeNonce is present, call
apiClient.clients.getHandshakePayload(), extract its directives and set cookiesHandshake now handles either handshakeNonce or handshakeToken cookies/params
Client‐side query param handling:
• Add __clerk_handshake_nonce to the list of recognized Clerk query parameters in getClerkQueryParam.ts.
• Strip __clerk_handshake_nonce (alongside other Clerk params) during URL cleanup in core/clerk.ts .
Related: SDKI-979
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change