Uh oh!
There was an error while loading. Please reload this page.
feat(*): auto-proxy for eligible hosts - #8035
Conversation
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: d0450ed The changes in this PR will be included in the next version bump. This PR includes changesets to release 20 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds exported functions 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
…omains Add automatic FAPI proxying detection for Vercel preview deployments across all SDKs. When an app is deployed to a .vercel.app subdomain without explicit proxy/domain configuration, the SDK automatically routes FAPI requests through the app's own domain via /__clerk proxy path. - Add isVercelPreviewDeploy() helper in @clerk/shared/proxy - Auto-detect in clerk-js proxyUrl getter for client-side SDK initialization - Auto-detect in @clerk/backend authenticateContext for server-side auth - Enable proxy interception in Next.js middleware for /__clerk/* requests on .vercel.app - Add comprehensive tests for all three layers (shared, backend, clerk-js, nextjs) Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
f73bc85 to
dbc580eCompare@clerk/astro@clerk/backend@clerk/chrome-extension@clerk/clerk-js@clerk/dev-cli@clerk/expo@clerk/expo-passkeys@clerk/express@clerk/fastify@clerk/hono@clerk/localizations@clerk/nextjs@clerk/nuxt@clerk/react@clerk/react-router@clerk/shared@clerk/tanstack-react-start@clerk/testing@clerk/ui@clerk/upgrade@clerk/vuecommit: |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.changeset/tiny-badgers-smile.md:
- Line 8: Update the changeset description sentence that currently reads "Add
auto-proxy detection for eligible hosts and generalize the internal helper
naming for future providers." to be specific about which hosts are considered
eligible (e.g., Vercel preview deployments) and to clarify the helper change;
for example, change the description to: "Add auto-proxy detection for Vercel
preview deployments (.vercel.app subdomains) and generalize the internal helper
for future hosting providers." Locate and edit the line containing that
description in the changeset (the sentence beginning "Add auto-proxy detection
for eligible hosts...") and replace it with the clearer, user-facing wording.
- Around line 1-6: The changeset incorrectly marks package bumps as 'patch' but
a new public API (shouldAutoProxy) was added; update the entries so any package
that exports the new function (at least '@clerk/shared', and any packages that
re-export it like '@clerk/backend', '@clerk/clerk-js', '@clerk/nextjs' if
applicable) use 'minor' instead of 'patch' in the
.changeset/tiny-badgers-smile.md file; ensure the header lines for those package
entries read 'minor' to reflect the new public API bump while keeping other
metadata unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 0cecde51-9659-43c2-8677-37774a033a71
📒 Files selected for processing (1)
.changeset/tiny-badgers-smile.md
| --- | ||
| '@clerk/backend': patch | ||
| '@clerk/clerk-js': patch | ||
| '@clerk/nextjs': patch | ||
| '@clerk/shared': patch | ||
| --- |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash# Description: Check if shouldAutoProxy is a public export# Search for shouldAutoProxy exports in the shared package
rg -n "export.*shouldAutoProxy" packages/shared/Repository: clerk/javascript
Length of output: 152
Update version bumps from patch to minor to reflect the new public API export.
The changeset marks all packages for patch bumps, but the PR introduces a new public API function shouldAutoProxy exported from @clerk/shared. Per semantic versioning standards, new public APIs require minor version bumps, not patch (which is reserved for bug fixes). Update the changeset accordingly.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.changeset/tiny-badgers-smile.md around lines 1 - 6, The changeset
incorrectly marks package bumps as 'patch' but a new public API
(shouldAutoProxy) was added; update the entries so any package that exports the
new function (at least '@clerk/shared', and any packages that re-export it like
'@clerk/backend', '@clerk/clerk-js', '@clerk/nextjs' if applicable) use 'minor'
instead of 'patch' in the .changeset/tiny-badgers-smile.md file; ensure the
header lines for those package entries read 'minor' to reflect the new public
API bump while keeping other metadata unchanged.
Uh oh!
There was an error while loading. Please reload this page.
brkalow
commented
Mar 20, 2026
!snapshot |
This comment has been minimized.
This comment has been minimized.
brkalow
commented
Mar 20, 2026
!snapshot |
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/shared/src/proxy.ts`:
- Around line 45-47: The normalizeHostname function can throw when called with a
malformed URL (e.g., VERCEL_PROJECT_PRODUCTION_URL); wrap the URL parsing in a
try-catch inside normalizeHostname (the function shown using new
URL(...).hostname) and return an empty string on error so config resolution
doesn't crash; ensure callers that rely on normalizeHostname (where
VERCEL_PROJECT_PRODUCTION_URL is passed) can handle an empty string result
gracefully.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 2ad9a329-ea13-4ffe-86f9-f7dec3b163e7
📒 Files selected for processing (5)
.changeset/tiny-badgers-smile.mdpackages/nextjs/src/utils/__tests__/mergeNextClerkPropsWithEnv.test.tspackages/nextjs/src/utils/mergeNextClerkPropsWithEnv.tspackages/shared/src/__tests__/proxy.spec.tspackages/shared/src/proxy.ts
| function normalizeHostname(hostnameOrUrl: string): string { | ||
| if (hostnameOrUrl.startsWith('http://') || hostnameOrUrl.startsWith('https://')) { | ||
| return new URL(hostnameOrUrl).hostname; |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash# Verify call path and URL constructor throw behavior
rg -n "normalizeHostname|getAutoProxyUrlFromEnvironment|VERCEL_PROJECT_PRODUCTION_URL" \
packages/shared/src/proxy.ts packages/nextjs/src/utils/mergeNextClerkPropsWithEnv.ts
node - <<'NODE'const samples = ['https://', 'https://?x=1', 'https:///foo', 'https://myapp.vercel.app'];for (const s of samples) { try { console.log(`${s} => hostname="${new URL(s).hostname}"`); } catch (e) { console.log(`${s} => THROWS (${e.name})`); }}NODERepository: clerk/javascript
Length of output: 853
🏁 Script executed:
#!/bin/bash# Get full function context at line 45-47 and surrounding linesecho"=== normalizeHostname function context (lines 41-55) ==="
sed -n '41,55p' packages/shared/src/proxy.ts | cat -n
echo -e "\n=== getAutoProxyUrlFromEnvironment call context (lines 70-80) ==="
sed -n '70,80p' packages/shared/src/proxy.ts | cat -n
# Search for tests related to proxy.ts or normalizeHostnameecho -e "\n=== Tests for proxy functions ==="
find . -name "*.test.ts" -o -name "*.spec.ts"| xargs grep -l "normalizeHostname\|getAutoProxyUrlFromEnvironment\|proxy"2>/dev/null | head -10Repository: clerk/javascript
Length of output: 1707
🏁 Script executed:
#!/bin/bash# Check if there are tests covering error cases for these functionsecho"=== Searching for test files related to proxy ==="
fd -e "test.ts" -e "spec.ts"| xargs grep -l "normalizeHostname\|getAutoProxyUrlFromEnvironment"2>/dev/null
# Also check the test directory structureecho -e "\n=== Checking __tests__ and test directory structure ==="
find packages/shared -type d \( -name "__tests__" -o -name "tests" -o -name "test"\)| head -5Repository: clerk/javascript
Length of output: 410
🏁 Script executed:
#!/bin/bash# Read the existing proxy test file to see current coverageecho"=== Existing proxy tests ==="
cat packages/shared/src/__tests__/proxy.spec.tsRepository: clerk/javascript
Length of output: 5211
Handle malformed VERCEL_PROJECT_PRODUCTION_URL in hostname normalization to prevent runtime crashes.
At line 76, normalizeHostname() is called with an environment variable without error handling. If VERCEL_PROJECT_PRODUCTION_URL is malformed (e.g., https:// or https://?x=1), new URL() throws a TypeError, crashing config resolution instead of gracefully returning an empty string. Add try-catch to safely handle this:
Proposed fix
function normalizeHostname(hostnameOrUrl: string): string {
if (hostnameOrUrl.startsWith('http://') || hostnameOrUrl.startsWith('https://')) {
- return new URL(hostnameOrUrl).hostname;+ try {+ return new URL(hostnameOrUrl).hostname;+ } catch {+ return '';+ }
}
return hostnameOrUrl.split('/')[0] || '';
}Also applies to: 76-77
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/shared/src/proxy.ts` around lines 45 - 47, The normalizeHostname
function can throw when called with a malformed URL (e.g.,
VERCEL_PROJECT_PRODUCTION_URL); wrap the URL parsing in a try-catch inside
normalizeHostname (the function shown using new URL(...).hostname) and return an
empty string on error so config resolution doesn't crash; ensure callers that
rely on normalizeHostname (where VERCEL_PROJECT_PRODUCTION_URL is passed) can
handle an empty string result gracefully.
brkalow
commented
Mar 20, 2026
!snapshot |
This comment has been minimized.
This comment has been minimized.
Railly
commented
Apr 21, 2026
!snapshot |
Hey @Railly - the snapshot version command generated the following package versions:
Tip: Use the snippet copy button below to quickly install the required packages. npm i @clerk/astro@3.0.18-snapshot.v20260421194054 --save-exact
npm i @clerk/backend@3.2.14-snapshot.v20260421194054 --save-exact
npm i @clerk/chrome-extension@3.1.15-snapshot.v20260421194054 --save-exact
npm i @clerk/clerk-js@6.7.5-snapshot.v20260421194054 --save-exact
npm i @clerk/dev-cli@0.1.1-snapshot.v20260421194054 --save-exact
npm i @clerk/expo@3.2.2-snapshot.v20260421194054 --save-exact
npm i @clerk/expo-passkeys@1.0.15-snapshot.v20260421194054 --save-exact
npm i @clerk/express@2.1.6-snapshot.v20260421194054 --save-exact
npm i @clerk/fastify@3.1.16-snapshot.v20260421194054 --save-exact
npm i @clerk/hono@0.1.16-snapshot.v20260421194054 --save-exact
npm i @clerk/localizations@4.5.3-snapshot.v20260421194054 --save-exact
npm i @clerk/msw@0.0.15-snapshot.v20260421194054 --save-exact
npm i @clerk/nextjs@7.2.4-snapshot.v20260421194054 --save-exact
npm i @clerk/nuxt@2.2.5-snapshot.v20260421194054 --save-exact
npm i @clerk/react@6.4.3-snapshot.v20260421194054 --save-exact
npm i @clerk/react-router@3.1.4-snapshot.v20260421194054 --save-exact
npm i @clerk/shared@4.8.3-snapshot.v20260421194054 --save-exact
npm i @clerk/tanstack-react-start@1.1.4-snapshot.v20260421194054 --save-exact
npm i @clerk/testing@2.0.18-snapshot.v20260421194054 --save-exact
npm i @clerk/ui@1.6.4-snapshot.v20260421194054 --save-exact
npm i @clerk/upgrade@2.0.3-snapshot.v20260421194054 --save-exact
npm i @clerk/vue@2.0.16-snapshot.v20260421194054 --save-exact |
Railly
commented
Apr 21, 2026
@Ephem Tested with a real production instance on vercel.app, auth works end-to-end. One finding: the default middleware matcher excludes Test app: https://v0-auto-proxy-test.vercel.app |
Ephem
left a comment
There was a problem hiding this comment.
I think this is looking really good, I only worry slightly about the backend case, made a suggestion.
We still need to figure out the /__clerk/(.*) not being in the matcher by default too. Not sure that's going to affect this PR though, but we should probably figure it out before merging.
Uh oh!
There was an error while loading. Please reload this page.
| ) { | ||
| // Auto-detect proxy for supported platform deployments (production only) | ||
| if (!options.proxyUrl && !options.domain && options.publishableKey?.startsWith('pk_live_')) { | ||
| const hostname = clerkRequest.clerkUrl.hostname; |
There was a problem hiding this comment.
I'm not sure a comment is enough here (it also doesn't explain why this is currently safe). It's very hard to fully understand the implications of something like this, especially as code changes over time, so I think it doesn't hurt to be defensive.
I wonder if we could straight up reuse getAutoProxyUrlFromEnvironment here (with minor tweaks)? That way, if the backend is deployed to Vercel auto-proxying will work correctly, which should be fine for the use case we are targeting?
If the backend is hosted separately, I think requiring you to configure a proxyUrl for it yourself is fair instead of picking it up from the header?
…n of getAutoProxyUrlFromEnvironment
Railly
commented
Apr 22, 2026
@Ephem addressed in |
Ephem
left a comment
There was a problem hiding this comment.
@Ephem addressed in 43be86f, replaced header-based detection with
getAutoProxyUrlFromEnvironmentin the backend. If deployed outside Vercel, auto-proxy simply doesn't activate and you configure proxyUrl manually.
Awesome, that sidesteps the concern entirely, thanks!
I think this is looking good to go now, great work Bryce on the original implementation and Railly on picking it up!
@nikosdouvlis Do you have any final concerns?
Railly
commented
Apr 28, 2026
hey @nikosdouvlis, could you merge this when you get a chance? I’m not the PR author so I don’t have permissions |
Description
This PR implements automatic FAPI proxying for Vercel preview deployments. When an app is deployed to a
.vercel.appsubdomain without explicit proxy or domain configuration, the SDK automatically routes FAPI requests through the app's own domain via the/__clerkproxy path.The auto-detection is centralized across all SDKs:
@clerk/shared/proxy): NewisVercelPreviewDeploy()helper detects.vercel.apphostnames@clerk/clerk-js): Auto-detect inproxyUrlgetter whenwindow.location.hostnameis.vercel.app@clerk/backend): Auto-detect inauthenticateContextconstructor when request hostname is.vercel.app@clerk/nextjs): Auto-enable proxy interception for/__clerk/*requests on.vercel.apphostnamesGuard conditions prevent auto-detection when explicit configuration is provided:
proxyUrl,domain, or environment variablesNEXT_PUBLIC_CLERK_PROXY_URL/NEXT_PUBLIC_CLERK_DOMAIN.Test Results
@clerk/shared: 981/981 tests passed@clerk/backend: 1114/1114 tests passed@clerk/clerk-js: 624/624 tests passed@clerk/nextjs: 362 tests passed (49 pre-existing failures unrelated to this change)Build verification: All packages build cleanly with no type errors.
Checklist
pnpm testruns as expectedpnpm buildruns as expectedType of change
Summary by CodeRabbit
New Features
Bug Fixes
Tests