') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix(express): add empty path fallback for frontendApiProxy by jacekradko · Pull Request #8003 · clerk/javascript · GitHub
Skip to content

fix(express): add empty path fallback for frontendApiProxy - #8003

Merged
jacekradko merged 3 commits into
mainfrom
jacek/fix-express-proxy-path-guard
Mar 7, 2026
Merged

fix(express): add empty path fallback for frontendApiProxy#8003
jacekradko merged 3 commits into
mainfrom
jacek/fix-express-proxy-path-guard

Conversation

@jacekradko

@jacekradkojacekradko commented Mar 6, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Fix missing empty-string fallback for frontendApiProxy.path in Express middleware
  • When path is set to '/', stripTrailingSlashes returns '', causing pathname.startsWith('') to match every request as a proxy request
  • Adds || DEFAULT_PROXY_PATH guard to match the existing pattern in @clerk/hono and @clerk/fastify

Test plan

  • Verify pnpm build passes
  • Verify existing Express proxy tests pass

Summary by CodeRabbit

  • Bug Fixes

    • Resolved an issue where the express proxy could incorrectly intercept all requests when its configured path resolved to an empty string, restoring correct routing and preventing unintended interception.

  • Tests

    • Added tests to verify the proxy fallback behavior and ensure non-proxy routes remain unaffected when the configured path is empty.

  • Documentation

    • Added a changelog entry documenting the patch release.

@jacekradko
fix(express): add empty path fallback for frontendApiProxy
f5d7a43
When `frontendApiProxy.path` is set to '/', `stripTrailingSlashes`
returns an empty string, causing every request to be intercepted as
a proxy request. Add `|| DEFAULT_PROXY_PATH` fallback to match the
existing guard in the hono and fastify packages.
@vercel

vercelBot commented Mar 6, 2026•
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxSkippedSkippedMar 6, 2026 4:11pm

Request Review

@changeset-bot

changeset-botBot commented Mar 6, 2026•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 08c1d22

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
NameType
@clerk/expressPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-newBot commented Mar 6, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8003

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8003

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8003

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8003

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8003

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8003

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8003

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8003

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8003

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8003

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8003

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8003

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8003

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8003

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8003

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8003

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8003

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8003

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8003

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8003

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8003

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8003

commit: 08c1d22

@jacekradko
jacekradko requested a review from brkalowMarch 6, 2026 16:07
@coderabbitai

coderabbitaiBot commented Mar 6, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 0e9af587-94c0-4de7-8d74-a724725a8cd5

📥 Commits

Reviewing files that changed from the base of the PR and between 98161b0 and 08c1d22.

📒 Files selected for processing (1)
  • packages/express/src/__tests__/clerkMiddleware.test.ts
📝 Walkthrough

Walkthrough

Adds a fallback for an empty frontend API proxy path: when the configured proxy path becomes an empty string after trimming, the code uses DEFAULT_PROXY_PATH instead of the empty value. Adds tests covering this behavior and a changeset entry documenting a patch release for the clerk/express package.

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and concisely describes the main change: adding an empty path fallback for frontendApiProxy in Express middleware.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Tip

Try Coding Plans. Let us write the prompt for your AI agent so you can ship faster (with fewer bugs).
Share your feedback on Discord.

Comment @coderabbitai help to get the list of available commands and usage tips.

@jacekradko
jacekradko merged commit ab3fb7c into mainMar 7, 2026
41 checks passed
@jacekradko
jacekradko deleted the jacek/fix-express-proxy-path-guard branch March 7, 2026 12:02
@clerk-cookieclerk-cookie mentioned this pull request Mar 7, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@brkalowbrkalowbrkalow approved these changes

Assignees

No one assigned

Labels

express

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jacekradko@brkalow