Uh oh!
There was an error while loading. Please reload this page.
feat(clerk-js,ui,shared): Add Safari ITP decorateUrl workaround to setActive - #7623
Merged
Conversation
…ack for Safari ITP fix Why: Safari's Intelligent Tracking Prevention (ITP) caps cookies set via fetch/XHR to 7 days. When users switched from redirectUrl to the navigate callback pattern, the existing ITP workaround (via /v1/client/touch endpoint) stopped working because the touch endpoint logic only ran in the redirectUrl branch. What changed: - Added decorateUrl function to the navigate callback that wraps URLs with the touch endpoint when Safari ITP fix is needed (client.isEligibleForTouch()) - Updated SetActiveNavigate type signature to include decorateUrl parameter - Added dev-mode warning when decorateUrl is not called but ITP fix is needed - Updated all internal usages in SignIn, SignUp, and SessionTasks components to pass decorateUrl through navigateOnSetActive Context: The decorateUrl may return an external URL (https://...) when ITP fix is needed, requiring window.location.href instead of client-side navigation. This pattern is documented in the type definitions.
Why: The Safari ITP fix (decorateUrl in setActive) was added without integration test coverage. These tests ensure the touch endpoint navigation works correctly when the client cookie is close to expiration. What changed: - Added 4 tests covering the Safari ITP workaround flow - Tests verify touch endpoint is called when cookie expires within 8 days - Tests verify decorateUrl behavior with mocked isEligibleForTouch
🦋 Changeset detectedLatest commit: 32bf70a The changes in this PR will be included in the next version bump. This PR includes changesets to release 20 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📝 WalkthroughWalkthroughAdds a DecorateUrl callback to the setActive navigation flow and exports a DecorateUrl type. Propagates decorateUrl through core clerk logic, shared types, SignIn/SignUp/SessionTasks contexts, and numerous UI components so navigation handlers receive it. At runtime, decorateUrl may wrap redirect URLs to route eligible navigations through the /v1/client/touch endpoint (used for Safari ITP cookie refresh) and can trigger full-page navigation when the decorated URL is absolute. Includes unit tests for decorateUrl behavior and a Playwright integration test suite covering Safari ITP scenarios. 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
@clerk/agent-toolkit@clerk/astro@clerk/backend@clerk/chrome-extension@clerk/clerk-js@clerk/dev-cli@clerk/expo@clerk/expo-passkeys@clerk/express@clerk/fastify@clerk/localizations@clerk/nextjs@clerk/nuxt@clerk/react@clerk/react-router@clerk/shared@clerk/tanstack-react-start@clerk/testing@clerk/ui@clerk/upgrade@clerk/vuecommit: |
brkalow
reviewed
Jan 22, 2026
brkalow
left a comment
Member
There was a problem hiding this comment.
Implementation looks good! Does the warning fire reliably? I suppose yes, we're mostly safe because Clerk doesn't unmount / get cleaned up on navigations, unless it's a full navigation.
bratsos
reviewed
Jan 26, 2026
| 'Clerk: The navigate callback in setActive() did not call decorateUrl(). ' + | ||
| 'In Safari, sessions may be limited to 7 days due to Intelligent Tracking Prevention (ITP). ' + | ||
| 'Use decorateUrl() to wrap your destination URL to enable the ITP workaround. ' + | ||
| 'Learn more: https://clerk.com/docs/troubleshooting/safari-itp', |
MemberAuthor
There was a problem hiding this comment.
fixed the link and opened clerk/clerk-docs#3013, thanks Alex!
# Conflicts: # packages/ui/src/components/SignIn/handleCombinedFlowTransfer.ts
Why:
The previous check `decoratedUrl.startsWith('https://')` incorrectly triggered full page navigation for any absolute https:// redirect URL, even when decorateUrl didn't modify it. This caused unnecessary full page navigations in non-ITP scenarios.
What changed:
Now checks if decorateUrl actually modified the URL (`decoratedUrl !== redirectUrl`) AND that the result is an absolute http/https URL. This ensures full page navigation only happens when Safari ITP decoration is applied.The buildTouchUrl mock wasn't URL-encoding the redirect URL, but the test expected %2Fdashboard in the result. The real implementation uses fapiClient which handles encoding, so the mock should too.
The setActive mock was calling navigate({ session }) but the actual code
now expects navigate({ session, decorateUrl }). Added a mock decorateUrl
function to fix the test.alexcarpenter
approved these changes
Jan 29, 2026
The route pattern '**/v1/client?**' required a query string to match, so it was missing client fetches without query params. Changed to '**/v1/client**' and added explicit skip for touch endpoint to avoid intercepting that separately.
…sponses Intercepting /v1/client responses breaks JWT signature validation since we can't re-sign the handshake token. The decorateUrl functionality is still tested in the remaining tests which call setActive directly after successful sign-in.
Uh oh!
There was an error while loading. Please reload this page.
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Why:
Safari's Intelligent Tracking Prevention (ITP) caps cookies set via fetch/XHR
to 7 days. When users switched from redirectUrl to the navigate callback pattern,
the existing ITP workaround (via /v1/client/touch endpoint) stopped working
because the touch endpoint logic only ran in the redirectUrl branch.
What changed:
touch endpoint when Safari ITP fix is needed (client.isEligibleForTouch())
to pass decorateUrl through navigateOnSetActive
Context:
The decorateUrl may return an external URL (https://...) when ITP fix is needed,
requiring window.location.href instead of client-side navigation. This pattern
is documented in the type definitions.
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change
Summary by CodeRabbit
New Features
Tests
✏️ Tip: You can customize this high-level summary in your review settings.