Skip to content

feat(clerk-js,shared): Remove expired_token retry flow#8108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nikosdouvlis merged 3 commits into from
Mar 24, 2026
Merged

feat(clerk-js,shared): Remove expired_token retry flow #8108

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3eb6e94
feat(clerk-js,shared): Remove expired_token retry flow
nikosdouvlis Mar 18, 2026
f20febc
feat(clerk-js): Gate expired_token retry removal behind sessionMinter…
nikosdouvlis Mar 23, 2026
e85157d
chore(clerk-js): Add TODO to remove expired_token flow with sessionMi…
nikosdouvlis Mar 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/remove-expired-token-retry.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': patch
---

Skip `expired_token` retry flow when Session Minter is enabled. When `sessionMinter` is on, the token is sent in the POST body, so the retry-with-expired-token fallback is unnecessary. The retry flow is preserved for non-Session Minter mode.
12 changes: 8 additions & 4 deletions packages/clerk-js/src/core/resources/Session.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -490,16 +490,20 @@ export class Session extends BaseResource implements SessionResource {
organizationId: organizationId ?? null,
...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
};
const lastActiveToken = this.lastActiveToken?.getRawString();

const tokenResolver = Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
if (sessionMinterEnabled) {
// Session Minter sends the token in the body, no expired_token retry needed
return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
}

// TODO: Remove this expired_token retry flow when the sessionMinter flag is removed
const lastActiveToken = this.lastActiveToken?.getRawString();
return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
if (MissingExpiredTokenError.is(e) && lastActiveToken) {
return Token.create(path, { ...params }, { expired_token: lastActiveToken });
}
Comment on lines +494 to 503

@coderabbitaicoderabbitaiBotMar 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Remove expired_token retry path entirely to prevent JWT query-string leakage

Line 500-503 still retries with expired_token in the URL query. This keeps the exact leakage risk (logs/proxies/referrers) this PR is intended to eliminate. Also, gating body token by sessionMinterEnabled (Line 491) conflicts with the objective that token is now sent in POST body for /tokens.

Proposed fix
@@
import {
ClerkOfflineError,
ClerkRuntimeError,
ClerkWebAuthnError,
is4xxError,
is429Error,
- MissingExpiredTokenError,
} from '@clerk/shared/error';
@@
`#createTokenResolver`(
template: string | undefined,
organizationId: string | undefined | null,
skipCache: boolean,
): Promise<TokenResource> {
@@
- const sessionMinterEnabled = Session.clerk?.__internal_environment?.authConfig?.sessionMinter;
const params: Record<string, string | null> = template
? {}
: {
organizationId: organizationId ?? null,
- ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),+ ...(this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
};
-- if (sessionMinterEnabled) {- // Session Minter sends the token in the body, no expired_token retry needed- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);- }-- const lastActiveToken = this.lastActiveToken?.getRawString();- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {- if (MissingExpiredTokenError.is(e) && lastActiveToken) {- return Token.create(path, { ...params }, { expired_token: lastActiveToken });- }- throw e;- });+ return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/resources/Session.ts` around lines 494 - 503, The
code still retries with expired_token in the query string (using Token.create in
the catch and MissingExpiredTokenError with lastActiveToken), which reintroduces
JWT-in-URL leakage; remove that retry branch entirely and stop passing
expired_token via query params. Update the logic around sessionMinterEnabled and
the Token.create calls so that /tokens requests always send the token in the
POST body (not in query params) and eliminate the catch block that checks
MissingExpiredTokenError/lastActiveToken and re-invokes Token.create with {
expired_token: ... }.

throw e;
});

return tokenResolver;
}

#dispatchTokenEvents(token: TokenResource, shouldDispatch: boolean): void {
Expand Down
16 changes: 4 additions & 12 deletions scripts/validate-staging-instances.test.mjs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -229,9 +229,7 @@ describe('collapseAttributeMismatches', () => {
{ path: 'user_settings.attributes.phone_number.verifications', prod: ['phone_code'], staging: [] },
];
const result = collapseAttributeMismatches(mismatches);
expect(result).toEqual([
{ path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false },
]);
expect(result).toEqual([{ path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false }]);
});

it('keeps child diffs when .enabled does NOT differ', () => {
Expand DownExpand Up@@ -286,9 +284,7 @@ describe('collapseSocialMismatches', () => {
{ path: 'user_settings.social.google.strategy', prod: 'oauth_google', staging: undefined },
];
const result = collapseSocialMismatches(mismatches);
expect(result).toEqual([
{ path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined },
]);
expect(result).toEqual([{ path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined }]);
});

it('collapses child diffs for extra social provider on staging', () => {
Expand All@@ -297,9 +293,7 @@ describe('collapseSocialMismatches', () => {
{ path: 'user_settings.social.github.enabled', prod: undefined, staging: true },
];
const result = collapseSocialMismatches(mismatches);
expect(result).toEqual([
{ path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } },
]);
expect(result).toEqual([{ path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } }]);
});

it('keeps child diffs when both prod and staging have the provider', () => {
Expand All@@ -313,9 +307,7 @@ describe('collapseSocialMismatches', () => {
});

it('does not affect non-social mismatches', () => {
const mismatches = [
{ path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 },
];
const mismatches = [{ path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 }];
const result = collapseSocialMismatches(mismatches);
expect(result).toEqual(mismatches);
});
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
feat(clerk-js,shared): Remove expired_token retry flow by nikosdouvlis · Pull Request #8108 · clerk/javascript · GitHub
Skip to content
feat(clerk-js,shared): Remove expired_token retry flow#8108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

nikosdouvlis
merged 3 commits into

from

Mar 24, 2026
 Merged


feat(clerk-js,shared): Remove expired_token retry flow
#8108
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3eb6e94

feat(clerk-js,shared): Remove expired_token retry flow


nikosdouvlis Mar 18, 2026
f20febc

feat(clerk-js): Gate expired_token retry removal behind sessionMinter…


nikosdouvlis Mar 23, 2026
e85157d

chore(clerk-js): Add TODO to remove expired_token flow with sessionMi…


nikosdouvlis Mar 23, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/remove-expired-token-retry.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': patch
---

Skip `expired_token` retry flow when Session Minter is enabled. When `sessionMinter` is on, the token is sent in the POST body, so the retry-with-expired-token fallback is unnecessary. The retry flow is preserved for non-Session Minter mode.

12 changes: 8 additions & 4 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,16 +490,20 @@ export class Session extends BaseResource implements SessionResource {
 organizationId: organizationId ?? null,
 ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
 };
 const lastActiveToken = this.lastActiveToken?.getRawString();

 const tokenResolver = Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (sessionMinterEnabled) {
 // Session Minter sends the token in the body, no expired_token retry needed
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
 }

 // TODO: Remove this expired_token retry flow when the sessionMinter flag is removed
 const lastActiveToken = this.lastActiveToken?.getRawString();
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (MissingExpiredTokenError.is(e) && lastActiveToken) {
 return Token.create(path, { ...params }, { expired_token: lastActiveToken });
 }

Comment on lines

+494
 to 
503

@coderabbitaicoderabbitaiBotMar 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical
Remove expired_token retry path entirely to prevent JWT query-string leakage
Line 500-503 still retries with expired_token in the URL query. This keeps the exact leakage risk (logs/proxies/referrers) this PR is intended to eliminate. Also, gating body token by sessionMinterEnabled (Line 491) conflicts with the objective that token is now sent in POST body for /tokens.
Proposed fix
@@
import {
ClerkOfflineError,
ClerkRuntimeError,
ClerkWebAuthnError,
is4xxError,
is429Error,
- MissingExpiredTokenError,
} from '@clerk/shared/error';
@@
`#createTokenResolver`(
template: string | undefined,
organizationId: string | undefined | null,
skipCache: boolean,
): Promise<TokenResource> {
@@
- const sessionMinterEnabled = Session.clerk?.__internal_environment?.authConfig?.sessionMinter;
const params: Record<string, string | null> = template
? {}
: {
organizationId: organizationId ?? null,
- ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),+ ...(this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
};
-- if (sessionMinterEnabled) {- // Session Minter sends the token in the body, no expired_token retry needed- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);- }-- const lastActiveToken = this.lastActiveToken?.getRawString();- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {- if (MissingExpiredTokenError.is(e) && lastActiveToken) {- return Token.create(path, { ...params }, { expired_token: lastActiveToken });- }- throw e;- });+ return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/resources/Session.ts` around lines 494 - 503, The
code still retries with expired_token in the query string (using Token.create in
the catch and MissingExpiredTokenError with lastActiveToken), which reintroduces
JWT-in-URL leakage; remove that retry branch entirely and stop passing
expired_token via query params. Update the logic around sessionMinterEnabled and
the Token.create calls so that /tokens requests always send the token in the
POST body (not in query params) and eliminate the catch block that checks
MissingExpiredTokenError/lastActiveToken and re-invokes Token.create with {
expired_token: ... }.

 throw e;
 });

 return tokenResolver;
 }

 #dispatchTokenEvents(token: TokenResource, shouldDispatch: boolean): void {
Expand Down

16 changes: 4 additions & 12 deletions
scripts/validate-staging-instances.test.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -229,9 +229,7 @@ describe('collapseAttributeMismatches', () => {
 { path: 'user_settings.attributes.phone_number.verifications', prod: ['phone_code'], staging: [] },
 ];
 const result = collapseAttributeMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false },
 ]);
 expect(result).toEqual([{ path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false }]);
 });

 it('keeps child diffs when .enabled does NOT differ', () => {
Expand DownExpand Up@@ -286,9 +284,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.google.strategy', prod: 'oauth_google', staging: undefined },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined }]);
 });

 it('collapses child diffs for extra social provider on staging', () => {
Expand All@@ -297,9 +293,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.github.enabled', prod: undefined, staging: true },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } }]);
 });

 it('keeps child diffs when both prod and staging have the provider', () => {
Expand All@@ -313,9 +307,7 @@ describe('collapseSocialMismatches', () => {
 });

 it('does not affect non-social mismatches', () => {
 const mismatches = [
 { path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 },
 ];
 const mismatches = [{ path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 }];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual(mismatches);
 });
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(clerk-js,shared): Remove expired_token retry flow by nikosdouvlis · Pull Request #8108 · clerk/javascript · GitHub
Skip to content
feat(clerk-js,shared): Remove expired_token retry flow#8108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

nikosdouvlis
merged 3 commits into

from

Mar 24, 2026
 Merged


feat(clerk-js,shared): Remove expired_token retry flow
#8108
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3eb6e94

feat(clerk-js,shared): Remove expired_token retry flow


nikosdouvlis Mar 18, 2026
f20febc

feat(clerk-js): Gate expired_token retry removal behind sessionMinter…


nikosdouvlis Mar 23, 2026
e85157d

chore(clerk-js): Add TODO to remove expired_token flow with sessionMi…


nikosdouvlis Mar 23, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/remove-expired-token-retry.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': patch
---

Skip `expired_token` retry flow when Session Minter is enabled. When `sessionMinter` is on, the token is sent in the POST body, so the retry-with-expired-token fallback is unnecessary. The retry flow is preserved for non-Session Minter mode.

12 changes: 8 additions & 4 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,16 +490,20 @@ export class Session extends BaseResource implements SessionResource {
 organizationId: organizationId ?? null,
 ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
 };
 const lastActiveToken = this.lastActiveToken?.getRawString();

 const tokenResolver = Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (sessionMinterEnabled) {
 // Session Minter sends the token in the body, no expired_token retry needed
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
 }

 // TODO: Remove this expired_token retry flow when the sessionMinter flag is removed
 const lastActiveToken = this.lastActiveToken?.getRawString();
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (MissingExpiredTokenError.is(e) && lastActiveToken) {
 return Token.create(path, { ...params }, { expired_token: lastActiveToken });
 }

Comment on lines

+494
 to 
503

@coderabbitaicoderabbitaiBotMar 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical
Remove expired_token retry path entirely to prevent JWT query-string leakage
Line 500-503 still retries with expired_token in the URL query. This keeps the exact leakage risk (logs/proxies/referrers) this PR is intended to eliminate. Also, gating body token by sessionMinterEnabled (Line 491) conflicts with the objective that token is now sent in POST body for /tokens.
Proposed fix
@@
import {
ClerkOfflineError,
ClerkRuntimeError,
ClerkWebAuthnError,
is4xxError,
is429Error,
- MissingExpiredTokenError,
} from '@clerk/shared/error';
@@
`#createTokenResolver`(
template: string | undefined,
organizationId: string | undefined | null,
skipCache: boolean,
): Promise<TokenResource> {
@@
- const sessionMinterEnabled = Session.clerk?.__internal_environment?.authConfig?.sessionMinter;
const params: Record<string, string | null> = template
? {}
: {
organizationId: organizationId ?? null,
- ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),+ ...(this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
};
-- if (sessionMinterEnabled) {- // Session Minter sends the token in the body, no expired_token retry needed- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);- }-- const lastActiveToken = this.lastActiveToken?.getRawString();- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {- if (MissingExpiredTokenError.is(e) && lastActiveToken) {- return Token.create(path, { ...params }, { expired_token: lastActiveToken });- }- throw e;- });+ return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/resources/Session.ts` around lines 494 - 503, The
code still retries with expired_token in the query string (using Token.create in
the catch and MissingExpiredTokenError with lastActiveToken), which reintroduces
JWT-in-URL leakage; remove that retry branch entirely and stop passing
expired_token via query params. Update the logic around sessionMinterEnabled and
the Token.create calls so that /tokens requests always send the token in the
POST body (not in query params) and eliminate the catch block that checks
MissingExpiredTokenError/lastActiveToken and re-invokes Token.create with {
expired_token: ... }.

 throw e;
 });

 return tokenResolver;
 }

 #dispatchTokenEvents(token: TokenResource, shouldDispatch: boolean): void {
Expand Down

16 changes: 4 additions & 12 deletions
scripts/validate-staging-instances.test.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -229,9 +229,7 @@ describe('collapseAttributeMismatches', () => {
 { path: 'user_settings.attributes.phone_number.verifications', prod: ['phone_code'], staging: [] },
 ];
 const result = collapseAttributeMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false },
 ]);
 expect(result).toEqual([{ path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false }]);
 });

 it('keeps child diffs when .enabled does NOT differ', () => {
Expand DownExpand Up@@ -286,9 +284,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.google.strategy', prod: 'oauth_google', staging: undefined },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined }]);
 });

 it('collapses child diffs for extra social provider on staging', () => {
Expand All@@ -297,9 +293,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.github.enabled', prod: undefined, staging: true },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } }]);
 });

 it('keeps child diffs when both prod and staging have the provider', () => {
Expand All@@ -313,9 +307,7 @@ describe('collapseSocialMismatches', () => {
 });

 it('does not affect non-social mismatches', () => {
 const mismatches = [
 { path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 },
 ];
 const mismatches = [{ path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 }];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual(mismatches);
 });
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(clerk-js,shared): Remove expired_token retry flow by nikosdouvlis · Pull Request #8108 · clerk/javascript · GitHub
Skip to content
feat(clerk-js,shared): Remove expired_token retry flow#8108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

nikosdouvlis
merged 3 commits into

from

Mar 24, 2026
 Merged


feat(clerk-js,shared): Remove expired_token retry flow
#8108
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3eb6e94

feat(clerk-js,shared): Remove expired_token retry flow


nikosdouvlis Mar 18, 2026
f20febc

feat(clerk-js): Gate expired_token retry removal behind sessionMinter…


nikosdouvlis Mar 23, 2026
e85157d

chore(clerk-js): Add TODO to remove expired_token flow with sessionMi…


nikosdouvlis Mar 23, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/remove-expired-token-retry.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': patch
---

Skip `expired_token` retry flow when Session Minter is enabled. When `sessionMinter` is on, the token is sent in the POST body, so the retry-with-expired-token fallback is unnecessary. The retry flow is preserved for non-Session Minter mode.

12 changes: 8 additions & 4 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,16 +490,20 @@ export class Session extends BaseResource implements SessionResource {
 organizationId: organizationId ?? null,
 ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
 };
 const lastActiveToken = this.lastActiveToken?.getRawString();

 const tokenResolver = Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (sessionMinterEnabled) {
 // Session Minter sends the token in the body, no expired_token retry needed
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
 }

 // TODO: Remove this expired_token retry flow when the sessionMinter flag is removed
 const lastActiveToken = this.lastActiveToken?.getRawString();
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (MissingExpiredTokenError.is(e) && lastActiveToken) {
 return Token.create(path, { ...params }, { expired_token: lastActiveToken });
 }

Comment on lines

+494
 to 
503

@coderabbitaicoderabbitaiBotMar 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical
Remove expired_token retry path entirely to prevent JWT query-string leakage
Line 500-503 still retries with expired_token in the URL query. This keeps the exact leakage risk (logs/proxies/referrers) this PR is intended to eliminate. Also, gating body token by sessionMinterEnabled (Line 491) conflicts with the objective that token is now sent in POST body for /tokens.
Proposed fix
@@
import {
ClerkOfflineError,
ClerkRuntimeError,
ClerkWebAuthnError,
is4xxError,
is429Error,
- MissingExpiredTokenError,
} from '@clerk/shared/error';
@@
`#createTokenResolver`(
template: string | undefined,
organizationId: string | undefined | null,
skipCache: boolean,
): Promise<TokenResource> {
@@
- const sessionMinterEnabled = Session.clerk?.__internal_environment?.authConfig?.sessionMinter;
const params: Record<string, string | null> = template
? {}
: {
organizationId: organizationId ?? null,
- ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),+ ...(this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
};
-- if (sessionMinterEnabled) {- // Session Minter sends the token in the body, no expired_token retry needed- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);- }-- const lastActiveToken = this.lastActiveToken?.getRawString();- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {- if (MissingExpiredTokenError.is(e) && lastActiveToken) {- return Token.create(path, { ...params }, { expired_token: lastActiveToken });- }- throw e;- });+ return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/resources/Session.ts` around lines 494 - 503, The
code still retries with expired_token in the query string (using Token.create in
the catch and MissingExpiredTokenError with lastActiveToken), which reintroduces
JWT-in-URL leakage; remove that retry branch entirely and stop passing
expired_token via query params. Update the logic around sessionMinterEnabled and
the Token.create calls so that /tokens requests always send the token in the
POST body (not in query params) and eliminate the catch block that checks
MissingExpiredTokenError/lastActiveToken and re-invokes Token.create with {
expired_token: ... }.

 throw e;
 });

 return tokenResolver;
 }

 #dispatchTokenEvents(token: TokenResource, shouldDispatch: boolean): void {
Expand Down

16 changes: 4 additions & 12 deletions
scripts/validate-staging-instances.test.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -229,9 +229,7 @@ describe('collapseAttributeMismatches', () => {
 { path: 'user_settings.attributes.phone_number.verifications', prod: ['phone_code'], staging: [] },
 ];
 const result = collapseAttributeMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false },
 ]);
 expect(result).toEqual([{ path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false }]);
 });

 it('keeps child diffs when .enabled does NOT differ', () => {
Expand DownExpand Up@@ -286,9 +284,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.google.strategy', prod: 'oauth_google', staging: undefined },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined }]);
 });

 it('collapses child diffs for extra social provider on staging', () => {
Expand All@@ -297,9 +293,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.github.enabled', prod: undefined, staging: true },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } }]);
 });

 it('keeps child diffs when both prod and staging have the provider', () => {
Expand All@@ -313,9 +307,7 @@ describe('collapseSocialMismatches', () => {
 });

 it('does not affect non-social mismatches', () => {
 const mismatches = [
 { path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 },
 ];
 const mismatches = [{ path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 }];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual(mismatches);
 });
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
feat(clerk-js,shared): Remove expired_token retry flow by nikosdouvlis · Pull Request #8108 · clerk/javascript · GitHub
Skip to content
feat(clerk-js,shared): Remove expired_token retry flow#8108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

nikosdouvlis
merged 3 commits into

from

Mar 24, 2026
 Merged


feat(clerk-js,shared): Remove expired_token retry flow
#8108
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3eb6e94

feat(clerk-js,shared): Remove expired_token retry flow


nikosdouvlis Mar 18, 2026
f20febc

feat(clerk-js): Gate expired_token retry removal behind sessionMinter…


nikosdouvlis Mar 23, 2026
e85157d

chore(clerk-js): Add TODO to remove expired_token flow with sessionMi…


nikosdouvlis Mar 23, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/remove-expired-token-retry.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': patch
---

Skip `expired_token` retry flow when Session Minter is enabled. When `sessionMinter` is on, the token is sent in the POST body, so the retry-with-expired-token fallback is unnecessary. The retry flow is preserved for non-Session Minter mode.

12 changes: 8 additions & 4 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,16 +490,20 @@ export class Session extends BaseResource implements SessionResource {
 organizationId: organizationId ?? null,
 ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
 };
 const lastActiveToken = this.lastActiveToken?.getRawString();

 const tokenResolver = Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (sessionMinterEnabled) {
 // Session Minter sends the token in the body, no expired_token retry needed
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
 }

 // TODO: Remove this expired_token retry flow when the sessionMinter flag is removed
 const lastActiveToken = this.lastActiveToken?.getRawString();
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (MissingExpiredTokenError.is(e) && lastActiveToken) {
 return Token.create(path, { ...params }, { expired_token: lastActiveToken });
 }

Comment on lines

+494
 to 
503

@coderabbitaicoderabbitaiBotMar 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical
Remove expired_token retry path entirely to prevent JWT query-string leakage
Line 500-503 still retries with expired_token in the URL query. This keeps the exact leakage risk (logs/proxies/referrers) this PR is intended to eliminate. Also, gating body token by sessionMinterEnabled (Line 491) conflicts with the objective that token is now sent in POST body for /tokens.
Proposed fix
@@
import {
ClerkOfflineError,
ClerkRuntimeError,
ClerkWebAuthnError,
is4xxError,
is429Error,
- MissingExpiredTokenError,
} from '@clerk/shared/error';
@@
`#createTokenResolver`(
template: string | undefined,
organizationId: string | undefined | null,
skipCache: boolean,
): Promise<TokenResource> {
@@
- const sessionMinterEnabled = Session.clerk?.__internal_environment?.authConfig?.sessionMinter;
const params: Record<string, string | null> = template
? {}
: {
organizationId: organizationId ?? null,
- ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),+ ...(this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
};
-- if (sessionMinterEnabled) {- // Session Minter sends the token in the body, no expired_token retry needed- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);- }-- const lastActiveToken = this.lastActiveToken?.getRawString();- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {- if (MissingExpiredTokenError.is(e) && lastActiveToken) {- return Token.create(path, { ...params }, { expired_token: lastActiveToken });- }- throw e;- });+ return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/resources/Session.ts` around lines 494 - 503, The
code still retries with expired_token in the query string (using Token.create in
the catch and MissingExpiredTokenError with lastActiveToken), which reintroduces
JWT-in-URL leakage; remove that retry branch entirely and stop passing
expired_token via query params. Update the logic around sessionMinterEnabled and
the Token.create calls so that /tokens requests always send the token in the
POST body (not in query params) and eliminate the catch block that checks
MissingExpiredTokenError/lastActiveToken and re-invokes Token.create with {
expired_token: ... }.

 throw e;
 });

 return tokenResolver;
 }

 #dispatchTokenEvents(token: TokenResource, shouldDispatch: boolean): void {
Expand Down

16 changes: 4 additions & 12 deletions
scripts/validate-staging-instances.test.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -229,9 +229,7 @@ describe('collapseAttributeMismatches', () => {
 { path: 'user_settings.attributes.phone_number.verifications', prod: ['phone_code'], staging: [] },
 ];
 const result = collapseAttributeMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false },
 ]);
 expect(result).toEqual([{ path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false }]);
 });

 it('keeps child diffs when .enabled does NOT differ', () => {
Expand DownExpand Up@@ -286,9 +284,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.google.strategy', prod: 'oauth_google', staging: undefined },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined }]);
 });

 it('collapses child diffs for extra social provider on staging', () => {
Expand All@@ -297,9 +293,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.github.enabled', prod: undefined, staging: true },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } }]);
 });

 it('keeps child diffs when both prod and staging have the provider', () => {
Expand All@@ -313,9 +307,7 @@ describe('collapseSocialMismatches', () => {
 });

 it('does not affect non-social mismatches', () => {
 const mismatches = [
 { path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 },
 ];
 const mismatches = [{ path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 }];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual(mismatches);
 });
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(clerk-js,shared): Remove expired_token retry flow by nikosdouvlis · Pull Request #8108 · clerk/javascript · GitHub
Skip to content
feat(clerk-js,shared): Remove expired_token retry flow#8108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

nikosdouvlis
merged 3 commits into

from

Mar 24, 2026
 Merged


feat(clerk-js,shared): Remove expired_token retry flow
#8108
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3eb6e94

feat(clerk-js,shared): Remove expired_token retry flow


nikosdouvlis Mar 18, 2026
f20febc

feat(clerk-js): Gate expired_token retry removal behind sessionMinter…


nikosdouvlis Mar 23, 2026
e85157d

chore(clerk-js): Add TODO to remove expired_token flow with sessionMi…


nikosdouvlis Mar 23, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/remove-expired-token-retry.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': patch
---

Skip `expired_token` retry flow when Session Minter is enabled. When `sessionMinter` is on, the token is sent in the POST body, so the retry-with-expired-token fallback is unnecessary. The retry flow is preserved for non-Session Minter mode.

12 changes: 8 additions & 4 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,16 +490,20 @@ export class Session extends BaseResource implements SessionResource {
 organizationId: organizationId ?? null,
 ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
 };
 const lastActiveToken = this.lastActiveToken?.getRawString();

 const tokenResolver = Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (sessionMinterEnabled) {
 // Session Minter sends the token in the body, no expired_token retry needed
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
 }

 // TODO: Remove this expired_token retry flow when the sessionMinter flag is removed
 const lastActiveToken = this.lastActiveToken?.getRawString();
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (MissingExpiredTokenError.is(e) && lastActiveToken) {
 return Token.create(path, { ...params }, { expired_token: lastActiveToken });
 }

Comment on lines

+494
 to 
503

@coderabbitaicoderabbitaiBotMar 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical
Remove expired_token retry path entirely to prevent JWT query-string leakage
Line 500-503 still retries with expired_token in the URL query. This keeps the exact leakage risk (logs/proxies/referrers) this PR is intended to eliminate. Also, gating body token by sessionMinterEnabled (Line 491) conflicts with the objective that token is now sent in POST body for /tokens.
Proposed fix
@@
import {
ClerkOfflineError,
ClerkRuntimeError,
ClerkWebAuthnError,
is4xxError,
is429Error,
- MissingExpiredTokenError,
} from '@clerk/shared/error';
@@
`#createTokenResolver`(
template: string | undefined,
organizationId: string | undefined | null,
skipCache: boolean,
): Promise<TokenResource> {
@@
- const sessionMinterEnabled = Session.clerk?.__internal_environment?.authConfig?.sessionMinter;
const params: Record<string, string | null> = template
? {}
: {
organizationId: organizationId ?? null,
- ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),+ ...(this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
};
-- if (sessionMinterEnabled) {- // Session Minter sends the token in the body, no expired_token retry needed- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);- }-- const lastActiveToken = this.lastActiveToken?.getRawString();- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {- if (MissingExpiredTokenError.is(e) && lastActiveToken) {- return Token.create(path, { ...params }, { expired_token: lastActiveToken });- }- throw e;- });+ return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/resources/Session.ts` around lines 494 - 503, The
code still retries with expired_token in the query string (using Token.create in
the catch and MissingExpiredTokenError with lastActiveToken), which reintroduces
JWT-in-URL leakage; remove that retry branch entirely and stop passing
expired_token via query params. Update the logic around sessionMinterEnabled and
the Token.create calls so that /tokens requests always send the token in the
POST body (not in query params) and eliminate the catch block that checks
MissingExpiredTokenError/lastActiveToken and re-invokes Token.create with {
expired_token: ... }.

 throw e;
 });

 return tokenResolver;
 }

 #dispatchTokenEvents(token: TokenResource, shouldDispatch: boolean): void {
Expand Down

16 changes: 4 additions & 12 deletions
scripts/validate-staging-instances.test.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -229,9 +229,7 @@ describe('collapseAttributeMismatches', () => {
 { path: 'user_settings.attributes.phone_number.verifications', prod: ['phone_code'], staging: [] },
 ];
 const result = collapseAttributeMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false },
 ]);
 expect(result).toEqual([{ path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false }]);
 });

 it('keeps child diffs when .enabled does NOT differ', () => {
Expand DownExpand Up@@ -286,9 +284,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.google.strategy', prod: 'oauth_google', staging: undefined },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined }]);
 });

 it('collapses child diffs for extra social provider on staging', () => {
Expand All@@ -297,9 +293,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.github.enabled', prod: undefined, staging: true },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } }]);
 });

 it('keeps child diffs when both prod and staging have the provider', () => {
Expand All@@ -313,9 +307,7 @@ describe('collapseSocialMismatches', () => {
 });

 it('does not affect non-social mismatches', () => {
 const mismatches = [
 { path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 },
 ];
 const mismatches = [{ path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 }];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual(mismatches);
 });
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
feat(clerk-js,shared): Remove expired_token retry flow by nikosdouvlis · Pull Request #8108 · clerk/javascript · GitHub
Skip to content
feat(clerk-js,shared): Remove expired_token retry flow#8108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

nikosdouvlis
merged 3 commits into

from

Mar 24, 2026
 Merged


feat(clerk-js,shared): Remove expired_token retry flow
#8108
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3eb6e94

feat(clerk-js,shared): Remove expired_token retry flow


nikosdouvlis Mar 18, 2026
f20febc

feat(clerk-js): Gate expired_token retry removal behind sessionMinter…


nikosdouvlis Mar 23, 2026
e85157d

chore(clerk-js): Add TODO to remove expired_token flow with sessionMi…


nikosdouvlis Mar 23, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/remove-expired-token-retry.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': patch
---

Skip `expired_token` retry flow when Session Minter is enabled. When `sessionMinter` is on, the token is sent in the POST body, so the retry-with-expired-token fallback is unnecessary. The retry flow is preserved for non-Session Minter mode.

12 changes: 8 additions & 4 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,16 +490,20 @@ export class Session extends BaseResource implements SessionResource {
 organizationId: organizationId ?? null,
 ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
 };
 const lastActiveToken = this.lastActiveToken?.getRawString();

 const tokenResolver = Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (sessionMinterEnabled) {
 // Session Minter sends the token in the body, no expired_token retry needed
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
 }

 // TODO: Remove this expired_token retry flow when the sessionMinter flag is removed
 const lastActiveToken = this.lastActiveToken?.getRawString();
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (MissingExpiredTokenError.is(e) && lastActiveToken) {
 return Token.create(path, { ...params }, { expired_token: lastActiveToken });
 }

Comment on lines

+494
 to 
503

@coderabbitaicoderabbitaiBotMar 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical
Remove expired_token retry path entirely to prevent JWT query-string leakage
Line 500-503 still retries with expired_token in the URL query. This keeps the exact leakage risk (logs/proxies/referrers) this PR is intended to eliminate. Also, gating body token by sessionMinterEnabled (Line 491) conflicts with the objective that token is now sent in POST body for /tokens.
Proposed fix
@@
import {
ClerkOfflineError,
ClerkRuntimeError,
ClerkWebAuthnError,
is4xxError,
is429Error,
- MissingExpiredTokenError,
} from '@clerk/shared/error';
@@
`#createTokenResolver`(
template: string | undefined,
organizationId: string | undefined | null,
skipCache: boolean,
): Promise<TokenResource> {
@@
- const sessionMinterEnabled = Session.clerk?.__internal_environment?.authConfig?.sessionMinter;
const params: Record<string, string | null> = template
? {}
: {
organizationId: organizationId ?? null,
- ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),+ ...(this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
};
-- if (sessionMinterEnabled) {- // Session Minter sends the token in the body, no expired_token retry needed- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);- }-- const lastActiveToken = this.lastActiveToken?.getRawString();- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {- if (MissingExpiredTokenError.is(e) && lastActiveToken) {- return Token.create(path, { ...params }, { expired_token: lastActiveToken });- }- throw e;- });+ return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/resources/Session.ts` around lines 494 - 503, The
code still retries with expired_token in the query string (using Token.create in
the catch and MissingExpiredTokenError with lastActiveToken), which reintroduces
JWT-in-URL leakage; remove that retry branch entirely and stop passing
expired_token via query params. Update the logic around sessionMinterEnabled and
the Token.create calls so that /tokens requests always send the token in the
POST body (not in query params) and eliminate the catch block that checks
MissingExpiredTokenError/lastActiveToken and re-invokes Token.create with {
expired_token: ... }.

 throw e;
 });

 return tokenResolver;
 }

 #dispatchTokenEvents(token: TokenResource, shouldDispatch: boolean): void {
Expand Down

16 changes: 4 additions & 12 deletions
scripts/validate-staging-instances.test.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -229,9 +229,7 @@ describe('collapseAttributeMismatches', () => {
 { path: 'user_settings.attributes.phone_number.verifications', prod: ['phone_code'], staging: [] },
 ];
 const result = collapseAttributeMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false },
 ]);
 expect(result).toEqual([{ path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false }]);
 });

 it('keeps child diffs when .enabled does NOT differ', () => {
Expand DownExpand Up@@ -286,9 +284,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.google.strategy', prod: 'oauth_google', staging: undefined },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined }]);
 });

 it('collapses child diffs for extra social provider on staging', () => {
Expand All@@ -297,9 +293,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.github.enabled', prod: undefined, staging: true },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } }]);
 });

 it('keeps child diffs when both prod and staging have the provider', () => {
Expand All@@ -313,9 +307,7 @@ describe('collapseSocialMismatches', () => {
 });

 it('does not affect non-social mismatches', () => {
 const mismatches = [
 { path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 },
 ];
 const mismatches = [{ path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 }];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual(mismatches);
 });
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
feat(clerk-js,shared): Remove expired_token retry flow by nikosdouvlis · Pull Request #8108 · clerk/javascript · GitHub
Skip to content
feat(clerk-js,shared): Remove expired_token retry flow#8108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

nikosdouvlis
merged 3 commits into

from

Mar 24, 2026
 Merged


feat(clerk-js,shared): Remove expired_token retry flow
#8108
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


3 commits


Select commit
Hold shift + click to select a range
3eb6e94

feat(clerk-js,shared): Remove expired_token retry flow


nikosdouvlis Mar 18, 2026
f20febc

feat(clerk-js): Gate expired_token retry removal behind sessionMinter…


nikosdouvlis Mar 23, 2026
e85157d

chore(clerk-js): Add TODO to remove expired_token flow with sessionMi…


nikosdouvlis Mar 23, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


5 changes: 5 additions & 0 deletions
.changeset/remove-expired-token-retry.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
---
'@clerk/clerk-js': patch
---

Skip `expired_token` retry flow when Session Minter is enabled. When `sessionMinter` is on, the token is sent in the POST body, so the retry-with-expired-token fallback is unnecessary. The retry flow is preserved for non-Session Minter mode.

12 changes: 8 additions & 4 deletions
packages/clerk-js/src/core/resources/Session.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -490,16 +490,20 @@ export class Session extends BaseResource implements SessionResource {
 organizationId: organizationId ?? null,
 ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
 };
 const lastActiveToken = this.lastActiveToken?.getRawString();

 const tokenResolver = Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (sessionMinterEnabled) {
 // Session Minter sends the token in the body, no expired_token retry needed
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
 }

 // TODO: Remove this expired_token retry flow when the sessionMinter flag is removed
 const lastActiveToken = this.lastActiveToken?.getRawString();
 return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {
 if (MissingExpiredTokenError.is(e) && lastActiveToken) {
 return Token.create(path, { ...params }, { expired_token: lastActiveToken });
 }

Comment on lines

+494
 to 
503

@coderabbitaicoderabbitaiBotMar 23, 2026

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical
Remove expired_token retry path entirely to prevent JWT query-string leakage
Line 500-503 still retries with expired_token in the URL query. This keeps the exact leakage risk (logs/proxies/referrers) this PR is intended to eliminate. Also, gating body token by sessionMinterEnabled (Line 491) conflicts with the objective that token is now sent in POST body for /tokens.
Proposed fix
@@
import {
ClerkOfflineError,
ClerkRuntimeError,
ClerkWebAuthnError,
is4xxError,
is429Error,
- MissingExpiredTokenError,
} from '@clerk/shared/error';
@@
`#createTokenResolver`(
template: string | undefined,
organizationId: string | undefined | null,
skipCache: boolean,
): Promise<TokenResource> {
@@
- const sessionMinterEnabled = Session.clerk?.__internal_environment?.authConfig?.sessionMinter;
const params: Record<string, string | null> = template
? {}
: {
organizationId: organizationId ?? null,
- ...(sessionMinterEnabled && this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),+ ...(this.lastActiveToken ? { token: this.lastActiveToken.getRawString() } : {}),
};
-- if (sessionMinterEnabled) {- // Session Minter sends the token in the body, no expired_token retry needed- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);- }-- const lastActiveToken = this.lastActiveToken?.getRawString();- return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined).catch(e => {- if (MissingExpiredTokenError.is(e) && lastActiveToken) {- return Token.create(path, { ...params }, { expired_token: lastActiveToken });- }- throw e;- });+ return Token.create(path, params, skipCache ? { debug: 'skip_cache' } : undefined);
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/clerk-js/src/core/resources/Session.ts` around lines 494 - 503, The
code still retries with expired_token in the query string (using Token.create in
the catch and MissingExpiredTokenError with lastActiveToken), which reintroduces
JWT-in-URL leakage; remove that retry branch entirely and stop passing
expired_token via query params. Update the logic around sessionMinterEnabled and
the Token.create calls so that /tokens requests always send the token in the
POST body (not in query params) and eliminate the catch block that checks
MissingExpiredTokenError/lastActiveToken and re-invokes Token.create with {
expired_token: ... }.

 throw e;
 });

 return tokenResolver;
 }

 #dispatchTokenEvents(token: TokenResource, shouldDispatch: boolean): void {
Expand Down

16 changes: 4 additions & 12 deletions
scripts/validate-staging-instances.test.mjs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -229,9 +229,7 @@ describe('collapseAttributeMismatches', () => {
 { path: 'user_settings.attributes.phone_number.verifications', prod: ['phone_code'], staging: [] },
 ];
 const result = collapseAttributeMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false },
 ]);
 expect(result).toEqual([{ path: 'user_settings.attributes.phone_number.enabled', prod: true, staging: false }]);
 });

 it('keeps child diffs when .enabled does NOT differ', () => {
Expand DownExpand Up@@ -286,9 +284,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.google.strategy', prod: 'oauth_google', staging: undefined },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.google', prod: { enabled: true }, staging: undefined }]);
 });

 it('collapses child diffs for extra social provider on staging', () => {
Expand All@@ -297,9 +293,7 @@ describe('collapseSocialMismatches', () => {
 { path: 'user_settings.social.github.enabled', prod: undefined, staging: true },
 ];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual([
 { path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } },
 ]);
 expect(result).toEqual([{ path: 'user_settings.social.github', prod: undefined, staging: { enabled: true } }]);
 });

 it('keeps child diffs when both prod and staging have the provider', () => {
Expand All@@ -313,9 +307,7 @@ describe('collapseSocialMismatches', () => {
 });

 it('does not affect non-social mismatches', () => {
 const mismatches = [
 { path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 },
 ];
 const mismatches = [{ path: 'auth_config.session_token_ttl', prod: 3600, staging: 7200 }];
 const result = collapseSocialMismatches(mismatches);
 expect(result).toEqual(mismatches);
 });
Expand Down
Loading