feat(clerk-js): Send force_origin on skipCache token requests by nikosdouvlis · Pull Request #8106 · clerk/javascript

nikosdouvlis · 2026-03-18T13:17:27Z

Why

When Session Minter is active, getToken({ skipCache: true }) could be routed to the edge minter instead of origin. The skipCache contract is "give me a token minted from authoritative DB data", so we need to tell the FAPI Proxy to bypass Session Minter.

What

Send force_origin=true in the query string when skipCache: true. The FAPI Proxy will use this to route directly to origin once Session Minter is enabled.

The param is currently ignored by the backend and will be wired up in PLAT-2472.

Test plan

Verify force_origin=true in query string when skipCache: true
Verify force_origin absent when skipCache: false
Existing skipCache flows still work

Summary by CodeRabbit

Bug Fixes
- Token refresh routing improved: when bypassing token cache with Session Minter enabled, token requests are routed to the origin to ensure reliable validation and refresh.
Tests
- Added integration and unit tests verifying token refresh behavior with and without Session Minter.
Chores
- Release notes/changeset added to document the patch.

changeset-bot · 2026-03-18T13:17:31Z

🦋 Changeset detected

Latest commit: ea801e3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-03-18T13:17:32Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Mar 24, 2026 9:14am

When getToken({ skipCache: true }) is called, send force_origin=true in the query string. This tells the FAPI Proxy to route directly to origin instead of Session Minter, preserving the skipCache contract of always returning authoritative DB-minted tokens.

…arams

Verify that getToken({ skipCache: true }) sends force_origin=true in the POST body, and that getToken() without skipCache does not include it.

pkg-pr-new · 2026-03-23T12:16:11Z

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8106

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8106

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8106

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8106

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8106

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8106

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8106

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8106

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8106

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8106

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8106

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8106

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8106

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8106

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8106

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8106

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8106

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8106

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8106

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8106

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8106

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8106

commit: ea801e3

coderabbitai · 2026-03-23T12:20:42Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 55c6d3a9-41ad-42bb-bef9-8451dca8f284

📥 Commits

Reviewing files that changed from the base of the PR and between c755759 and ea801e3.

📒 Files selected for processing (1)

integration/tests/resiliency.test.ts

📝 Walkthrough

Walkthrough

A changeset for @clerk/clerk-js with a patch bump was added. The Session token resolver now includes forceOrigin: 'true' in request parameters when sessionMinter is enabled and skipCache is true, causing /tokens POST bodies to contain force_origin=true. Token.create handling was adjusted to send the parameter in the request body. Playwright and unit tests were added/updated to assert force_origin is present when skipCache and sessionMinter are true, and absent when either condition is false.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main feature: sending force_origin parameter on token requests when skipCache is used, which aligns with the core changes across Session.ts, tests, and the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@integration/tests/resiliency.test.ts`:
- Around line 561-564: The test currently asserts lastBody.get('force_origin')
unconditionally, which fails when sessionMinter is off; update the assertion to
first check the sessionMinter feature flag/state used in the test harness
(sessionMinter) and only assert that lastBody.get('force_origin') === 'true'
when sessionMinter is enabled, otherwise assert that force_origin is
absent/undefined (or not set) for the POST body; locate the assertion around the
expect(lastBody.get('force_origin')).toBe('true') and guard it with a
conditional based on the sessionMinter flag used by the test setup.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 17eb570d-456d-407f-82d1-037facb48e5c

📥 Commits

Reviewing files that changed from the base of the PR and between 3efdd2c and c755759.

📒 Files selected for processing (5)

.changeset/session-minter-force-origin.md
integration/tests/resiliency.test.ts
packages/clerk-js/src/core/resources/Session.ts
packages/clerk-js/src/core/resources/__tests__/Session.test.ts
packages/clerk-js/src/core/resources/__tests__/Token.test.ts

Resolve tokenCache.ts conflict by adopting main's orphan guard (cache.get(key) !== value short-circuit from #8098); drop the PR's redundant compare-and-swap. Monotonic enforcement remains at the broadcast handler, cookie write path, and Session resource where user-visible state lives. Drop stale changesets that were superseded by merged work: - session-minter-oiat-type.md (oiat field shipped via #8107) - session-minter-sdk-params.md (previous-token + force_origin shipped via #8105 + #8106 + #8107)

nikosdouvlis mentioned this pull request Mar 18, 2026
feat(clerk-js): Send previous token and force_origin on /tokens requests #8096
Closed
6 tasks

github-actionsBot added the clerk-js label Mar 18, 2026

vercelBotdeployed to Preview March 18, 2026 13:17 View deployment

bratsos approved these changes Mar 19, 2026
View reviewed changes

vercelBotdeployed to Preview March 23, 2026 11:22 View deployment

nikosdouvlis added 2 commits March 23, 2026 13:44

refactor(clerk-js): Send force_origin in POST body instead of query p…
f9c17fd
…arams

nikosdouvlis force-pushed the nikos/plat-2567-force-origin-on-skipcache branch from 9550a9a to f9c17fdCompare March 23, 2026 11:44

vercelBotdeployed to Preview March 23, 2026 11:45 View deployment

nikosdouvlis added 2 commits March 23, 2026 13:50

test(clerk-js): Add e2e test for force_origin body param
d735d70
Verify that getToken({ skipCache: true }) sends force_origin=true in the POST body, and that getToken() without skipCache does not include it.

test(clerk-js): Add unit tests for force_origin body param
900159d

github-actionsBot added the integration label Mar 23, 2026

vercelBotdeployed to Preview March 23, 2026 11:56 View deployment

fix(clerk-js): Gate force_origin behind sessionMinter flag
c755759

vercelBotdeployed to Preview March 23, 2026 12:06 View deployment

nikosdouvlis marked this pull request as ready for review March 23, 2026 12:13

nikosdouvlis closed this Mar 23, 2026

nikosdouvlis reopened this Mar 23, 2026

coderabbitaiBot reviewed Mar 23, 2026
View reviewed changes

Comment threadintegration/tests/resiliency.test.ts Outdated

fix(e2e): Gate force_origin assertion behind sessionMinter flag
ea801e3

vercelBotdeployed to Preview March 24, 2026 09:14 View deployment

nikosdouvlis merged commit d976a82 into mainMar 24, 2026
44 checks passed

nikosdouvlis deleted the nikos/plat-2567-force-origin-on-skipcache branch March 24, 2026 09:24

clerk-cookie mentioned this pull request Mar 24, 2026
ci(repo): Version packages #8146
Merged

wobsoriano pushed a commit that referenced this pull request Mar 26, 2026
feat(clerk-js): Send force_origin on skipCache token requests (#8106)
50c8606

nikosdouvlis mentioned this pull request May 26, 2026
feat(clerk-js,shared): Backport Session Minter SDK changes to core-2 #8643
Merged
5 tasks

Navigation Menu

Uh oh!

feat(clerk-js): Send force_origin on skipCache token requests - #8106

feat(clerk-js): Send force_origin on skipCache token requests#8106
nikosdouvlis merged 6 commits into
mainfrom
nikos/plat-2567-force-origin-on-skipcache

nikosdouvlis commented Mar 18, 2026•
edited by coderabbitai Bot
Loading

Uh oh!

changeset-botBot commented Mar 18, 2026•
edited
Loading

Uh oh!

vercelBot commented Mar 18, 2026•
edited
Loading

Uh oh!

pkg-pr-newBot commented Mar 23, 2026•
edited
Loading

Uh oh!

coderabbitaiBot commented Mar 23, 2026•
edited
Loading

Walkthrough

Uh oh!

coderabbitaiBot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

nikosdouvlis commented Mar 18, 2026• edited by coderabbitai BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

Test plan

Summary by CodeRabbit

Uh oh!

changeset-botBot commented Mar 18, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

vercelBot commented Mar 18, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-newBot commented Mar 23, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitaiBot commented Mar 23, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

coderabbitaiBot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nikosdouvlis commented Mar 18, 2026•
edited by coderabbitai Bot
Loading

changeset-botBot commented Mar 18, 2026•
edited
Loading

vercelBot commented Mar 18, 2026•
edited
Loading

pkg-pr-newBot commented Mar 23, 2026•
edited
Loading

coderabbitaiBot commented Mar 23, 2026•
edited
Loading