Skip to content

fix(backend): preserve Set-Cookie headers through proxy - #8162

Merged
brkalow merged 6 commits into
mainfrom
brkalow/fix-set-cookie-proxy
Mar 25, 2026
Merged

fix(backend): preserve Set-Cookie headers through proxy#8162
brkalow merged 6 commits into
mainfrom
brkalow/fix-set-cookie-proxy

Conversation

@brkalow

@brkalowbrkalow commented Mar 25, 2026•
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Member

Summary

  • Use headers.append() instead of headers.set() for set-cookie response headers in clerkFrontendApiProxy, fixing OAuth callback failures caused by dropped __client / __client_uat cookies
  • Add host validation guard to harden proxy

Test plan

  • Added test verifying multiple Set-Cookie headers are preserved through the proxy (using response.headers.getSetCookie())
  • Added test verifying protocol-relative SSRF paths are rejected with 400 before any fetch is made
  • All 38 existing proxy tests continue to pass

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Bug Fixes

    • Proxy now preserves and forwards multiple Set-Cookie headers from upstream to clients.

  • Security

    • Requests that resolve to a host different from the expected frontend API host are rejected with a 400 error.

  • Tests

    • Added tests covering Set-Cookie preservation and rejection of ambiguous/malicious proxy target resolutions.

@changeset-bot

changeset-botBot commented Mar 25, 2026•
edited
Loading

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 21a5805

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages
NameType
@clerk/backendPatch
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-newBot commented Mar 25, 2026•
edited
Loading

Copy link
Copy Markdown

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8162

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8162

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8162

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8162

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8162

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8162

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8162

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8162

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8162

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8162

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8162

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8162

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8162

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8162

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8162

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8162

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8162

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8162

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8162

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8162

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8162

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8162

commit: 21a5805

@jacekradko

jacekradko commented Mar 25, 2026

Copy link
Copy Markdown
Contributor

Classic headers issue!

@coderabbitai

coderabbitaiBot commented Mar 25, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3588d8fb-ac85-4b06-ad15-e87add47b135

📥 Commits

Reviewing files that changed from the base of the PR and between 1883b8f and 21a5805.

📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
📝 Walkthrough

Walkthrough

Adds a changeset for a patch release to `@clerk/backend`. Implements an SSRF guard by deriving the expected frontend API host from `fapiBaseUrl` and rejecting proxied requests whose resolved `targetUrl.host` differs with a 400 `proxy_request_failed` JSON error. Adjusts proxy response handling to append upstream `Set-Cookie` headers (preserving multiple cookies) while setting other headers normally. Adds tests for ambiguous/protocol-relative target URLs and preservation of multiple `Set-Cookie` headers.

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and directly describes the main change: preserving Set-Cookie headers through the proxy, which is the core fix addressing the OAuth callback failures mentioned in the PR objectives.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Comment @coderabbitai help to get the list of available commands and usage tips.

@brkalow@claude
fix(backend): preserve Set-Cookie headers and block SSRF in proxy
f390667
Use `headers.append()` instead of `headers.set()` for `set-cookie`
headers when copying FAPI response headers, preventing multiple
Set-Cookie values from being silently dropped (which caused OAuth
callback failures due to missing `__client` cookies).
Also add a host validation guard to prevent SSRF via protocol-relative
paths (e.g., `//evil.com/steal`) that would cause the URL constructor
to resolve to an attacker-controlled host, leaking the secret key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@brkalowbrkalow changed the title fix(backend): Append set-cookie headers in frontend proxyfix(backend): preserve Set-Cookie headers and block SSRF in proxyMar 25, 2026
@vercel

vercelBot commented Mar 25, 2026•
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentMar 25, 2026 6:26pm

Request Review

brkalow
brkalow commented Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts Outdated
jacekradko
jacekradko approved these changes Mar 25, 2026
View reviewed changes

@jacekradkojacekradko left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Good catch

@brkalow@claude
fix(backend): use string concatenation for FAPI URL to prevent SSRF b…
1883b8f
…y construction
Replace `new URL(path, base)` with string concatenation so that
protocol-relative paths like `//evil.com` can never change the host.
The defense-in-depth host check is kept as a belt-and-suspenders guard.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jacekradko
jacekradko reviewed Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
coderabbitai[bot]
coderabbitaiBot reviewed Mar 25, 2026
View reviewed changes

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/proxy.ts`:
- Around line 295-302: The bridge currently forwards response headers using
response.setHeader in the authenticateRequest flow which overwrites repeated
Set-Cookie values; update the header-forwarding loop in authenticateRequest (the
code that iterates response.headers and calls response.setHeader(key, value)) to
use response.appendHeader(key, value) for headers that may repeat (particularly
'set-cookie'), matching the approach used elsewhere (responseHeaders.append in
proxy.ts and the response.appendHeader call at line ~69), so multiple cookies
are preserved when sent to the client.
ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 79a73bb2-ec07-4aa9-8ca1-0967c86d9033

📥 Commits

Reviewing files that changed from the base of the PR and between 148923a and 1883b8f.

📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts

Comment threadpackages/backend/src/proxy.ts
brkalow
brkalow commented Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts Outdated
@brkalowbrkalow changed the title fix(backend): preserve Set-Cookie headers and block SSRF in proxyfix(backend): preserve Set-Cookie headers through proxyMar 25, 2026
brkalow
brkalow commented Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/__tests__/proxy.test.ts Outdated
@brkalow
brkalow merged commit 486545c into mainMar 25, 2026
44 checks passed
@brkalow
brkalow deleted the brkalow/fix-set-cookie-proxy branch March 25, 2026 18:35
@clerk-cookieclerk-cookie mentioned this pull request Mar 25, 2026
Merged
wobsoriano pushed a commit that referenced this pull request Mar 26, 2026
@brkalow@claude@wobsoriano
fix(backend): preserve Set-Cookie headers through proxy (#8162)
419da0f
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@jacekradkojacekradko mentioned this pull request Mar 26, 2026
Merged
5 tasks
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
+1 more reviewer
@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

backend

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@brkalow@jacekradko
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
fix(backend): preserve Set-Cookie headers through proxy by brkalow · Pull Request #8162 · clerk/javascript · GitHub
Skip to content
fix(backend): preserve Set-Cookie headers through proxy - #8162
Merged
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Mar 25, 2026
Merged
fix(backend): preserve Set-Cookie headers through proxy#8162
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Conversation
@brkalow
@brkalowbrkalow
commented
Mar 25, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • Use headers.append() instead of headers.set() for set-cookie response headers in clerkFrontendApiProxy, fixing OAuth callback failures caused by dropped __client / __client_uat cookies
  • Add host validation guard to harden proxy
Test plan
  •  Added test verifying multiple Set-Cookie headers are preserved through the proxy (using response.headers.getSetCookie())
  •  Added test verifying protocol-relative SSRF paths are rejected with 400 before any fetch is made
  •  All 38 existing proxy tests continue to pass
🤖 Generated with Claude Code
Summary by CodeRabbit
  • Bug Fixes
    • Proxy now preserves and forwards multiple Set-Cookie headers from upstream to clients.
  • Security
    • Requests that resolve to a host different from the expected frontend API host are rejected with a 400 error.
  • Tests
    • Added tests covering Set-Cookie preservation and rejection of ambiguous/malicious proxy target resolutions.
@changeset-bot
changeset-botBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 21a5805
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendPatch
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8162

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8162

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8162

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8162

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8162

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8162

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8162

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8162

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8162

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8162

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8162

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8162

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8162

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8162

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8162

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8162

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8162

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8162

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8162

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8162

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8162

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8162

commit: 21a5805
@jacekradko
jacekradko
commented
Mar 25, 2026

Copy link


Copy Markdown

Contributor
Classic headers issue!
@coderabbitai
coderabbitaiBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3588d8fb-ac85-4b06-ad15-e87add47b135
📥 Commits
Reviewing files that changed from the base of the PR and between 1883b8f and 21a5805.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
📝 Walkthrough
Walkthrough
Adds a changeset for a patch release to `@clerk/backend`. Implements an SSRF guard by deriving the expected frontend API host from `fapiBaseUrl` and rejecting proxied requests whose resolved `targetUrl.host` differs with a 400 `proxy_request_failed` JSON error. Adjusts proxy response handling to append upstream `Set-Cookie` headers (preserving multiple cookies) while setting other headers normally. Adds tests for ambiguous/protocol-relative target URLs and preservation of multiple `Set-Cookie` headers.
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and directly describes the main change: preserving Set-Cookie headers through the proxy, which is the core fix addressing the OAuth callback failures mentioned in the PR objectives.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brkalow@claude
fix(backend): preserve Set-Cookie headers and block SSRF in proxy
f390667
Use `headers.append()` instead of `headers.set()` for `set-cookie`
headers when copying FAPI response headers, preventing multiple
Set-Cookie values from being silently dropped (which caused OAuth
callback failures due to missing `__client` cookies).
Also add a host validation guard to prevent SSRF via protocol-relative
paths (e.g., `//evil.com/steal`) that would cause the URL constructor
to resolve to an attacker-controlled host, leaking the secret key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@brkalowbrkalow
changed the title
fix(backend): Append set-cookie headers in frontend proxyfix(backend): preserve Set-Cookie headers and block SSRF in proxyMar 25, 2026
@vercel
vercelBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentMar 25, 2026 6:26pm
Request Review
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

jacekradko
jacekradko
approved these changes
Mar 25, 2026
View reviewed changes
@jacekradkojacekradko
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Good catch
@brkalow@claude
fix(backend): use string concatenation for FAPI URL to prevent SSRF b…
1883b8f
…y construction
Replace `new URL(path, base)` with string concatenation so that
protocol-relative paths like `//evil.com` can never change the host.
The defense-in-depth host check is kept as a belt-and-suspenders guard.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jacekradko
jacekradko
reviewed
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
coderabbitai[bot]
coderabbitaiBot
reviewed
Mar 25, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/proxy.ts`:
- Around line 295-302: The bridge currently forwards response headers using
response.setHeader in the authenticateRequest flow which overwrites repeated
Set-Cookie values; update the header-forwarding loop in authenticateRequest (the
code that iterates response.headers and calls response.setHeader(key, value)) to
use response.appendHeader(key, value) for headers that may repeat (particularly
'set-cookie'), matching the approach used elsewhere (responseHeaders.append in
proxy.ts and the response.appendHeader call at line ~69), so multiple cookies
are preserved when sent to the client.

ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 79a73bb2-ec07-4aa9-8ca1-0967c86d9033
📥 Commits
Reviewing files that changed from the base of the PR and between 148923a and 1883b8f.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
Comment threadpackages/backend/src/proxy.ts
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

@brkalowbrkalow
changed the title
fix(backend): preserve Set-Cookie headers and block SSRF in proxyfix(backend): preserve Set-Cookie headers through proxyMar 25, 2026
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/__tests__/proxy.test.ts
Outdated

@brkalow
brkalow
merged commit 486545c
into
mainMar 25, 2026

44 checks passed

@brkalow
brkalow
deleted the

brkalow/fix-set-cookie-proxy

branch
March 25, 2026 18:35
@clerk-cookieclerk-cookie
mentioned this pull request
Mar 25, 2026
 Merged

wobsoriano pushed a commit
that referenced
this pull request
Mar 26, 2026
@brkalow@claude@wobsoriano
fix(backend): preserve Set-Cookie headers through proxy (#8162)
419da0f
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@jacekradkojacekradko
mentioned this pull request
Mar 26, 2026
 Merged

5 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments

+1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backend

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brkalow@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(backend): preserve Set-Cookie headers through proxy by brkalow · Pull Request #8162 · clerk/javascript · GitHub
Skip to content
fix(backend): preserve Set-Cookie headers through proxy - #8162
Merged
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Mar 25, 2026
Merged
fix(backend): preserve Set-Cookie headers through proxy#8162
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Conversation
@brkalow
@brkalowbrkalow
commented
Mar 25, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • Use headers.append() instead of headers.set() for set-cookie response headers in clerkFrontendApiProxy, fixing OAuth callback failures caused by dropped __client / __client_uat cookies
  • Add host validation guard to harden proxy
Test plan
  •  Added test verifying multiple Set-Cookie headers are preserved through the proxy (using response.headers.getSetCookie())
  •  Added test verifying protocol-relative SSRF paths are rejected with 400 before any fetch is made
  •  All 38 existing proxy tests continue to pass
🤖 Generated with Claude Code
Summary by CodeRabbit
  • Bug Fixes
    • Proxy now preserves and forwards multiple Set-Cookie headers from upstream to clients.
  • Security
    • Requests that resolve to a host different from the expected frontend API host are rejected with a 400 error.
  • Tests
    • Added tests covering Set-Cookie preservation and rejection of ambiguous/malicious proxy target resolutions.
@changeset-bot
changeset-botBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 21a5805
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendPatch
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8162

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8162

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8162

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8162

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8162

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8162

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8162

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8162

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8162

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8162

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8162

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8162

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8162

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8162

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8162

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8162

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8162

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8162

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8162

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8162

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8162

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8162

commit: 21a5805
@jacekradko
jacekradko
commented
Mar 25, 2026

Copy link


Copy Markdown

Contributor
Classic headers issue!
@coderabbitai
coderabbitaiBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3588d8fb-ac85-4b06-ad15-e87add47b135
📥 Commits
Reviewing files that changed from the base of the PR and between 1883b8f and 21a5805.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
📝 Walkthrough
Walkthrough
Adds a changeset for a patch release to `@clerk/backend`. Implements an SSRF guard by deriving the expected frontend API host from `fapiBaseUrl` and rejecting proxied requests whose resolved `targetUrl.host` differs with a 400 `proxy_request_failed` JSON error. Adjusts proxy response handling to append upstream `Set-Cookie` headers (preserving multiple cookies) while setting other headers normally. Adds tests for ambiguous/protocol-relative target URLs and preservation of multiple `Set-Cookie` headers.
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and directly describes the main change: preserving Set-Cookie headers through the proxy, which is the core fix addressing the OAuth callback failures mentioned in the PR objectives.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brkalow@claude
fix(backend): preserve Set-Cookie headers and block SSRF in proxy
f390667
Use `headers.append()` instead of `headers.set()` for `set-cookie`
headers when copying FAPI response headers, preventing multiple
Set-Cookie values from being silently dropped (which caused OAuth
callback failures due to missing `__client` cookies).
Also add a host validation guard to prevent SSRF via protocol-relative
paths (e.g., `//evil.com/steal`) that would cause the URL constructor
to resolve to an attacker-controlled host, leaking the secret key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@brkalowbrkalow
changed the title
fix(backend): Append set-cookie headers in frontend proxyfix(backend): preserve Set-Cookie headers and block SSRF in proxyMar 25, 2026
@vercel
vercelBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentMar 25, 2026 6:26pm
Request Review
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

jacekradko
jacekradko
approved these changes
Mar 25, 2026
View reviewed changes
@jacekradkojacekradko
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Good catch
@brkalow@claude
fix(backend): use string concatenation for FAPI URL to prevent SSRF b…
1883b8f
…y construction
Replace `new URL(path, base)` with string concatenation so that
protocol-relative paths like `//evil.com` can never change the host.
The defense-in-depth host check is kept as a belt-and-suspenders guard.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jacekradko
jacekradko
reviewed
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
coderabbitai[bot]
coderabbitaiBot
reviewed
Mar 25, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/proxy.ts`:
- Around line 295-302: The bridge currently forwards response headers using
response.setHeader in the authenticateRequest flow which overwrites repeated
Set-Cookie values; update the header-forwarding loop in authenticateRequest (the
code that iterates response.headers and calls response.setHeader(key, value)) to
use response.appendHeader(key, value) for headers that may repeat (particularly
'set-cookie'), matching the approach used elsewhere (responseHeaders.append in
proxy.ts and the response.appendHeader call at line ~69), so multiple cookies
are preserved when sent to the client.

ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 79a73bb2-ec07-4aa9-8ca1-0967c86d9033
📥 Commits
Reviewing files that changed from the base of the PR and between 148923a and 1883b8f.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
Comment threadpackages/backend/src/proxy.ts
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

@brkalowbrkalow
changed the title
fix(backend): preserve Set-Cookie headers and block SSRF in proxyfix(backend): preserve Set-Cookie headers through proxyMar 25, 2026
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/__tests__/proxy.test.ts
Outdated

@brkalow
brkalow
merged commit 486545c
into
mainMar 25, 2026

44 checks passed

@brkalow
brkalow
deleted the

brkalow/fix-set-cookie-proxy

branch
March 25, 2026 18:35
@clerk-cookieclerk-cookie
mentioned this pull request
Mar 25, 2026
 Merged

wobsoriano pushed a commit
that referenced
this pull request
Mar 26, 2026
@brkalow@claude@wobsoriano
fix(backend): preserve Set-Cookie headers through proxy (#8162)
419da0f
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@jacekradkojacekradko
mentioned this pull request
Mar 26, 2026
 Merged

5 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments

+1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backend

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brkalow@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(backend): preserve Set-Cookie headers through proxy by brkalow · Pull Request #8162 · clerk/javascript · GitHub
Skip to content
fix(backend): preserve Set-Cookie headers through proxy - #8162
Merged
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Mar 25, 2026
Merged
fix(backend): preserve Set-Cookie headers through proxy#8162
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Conversation
@brkalow
@brkalowbrkalow
commented
Mar 25, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • Use headers.append() instead of headers.set() for set-cookie response headers in clerkFrontendApiProxy, fixing OAuth callback failures caused by dropped __client / __client_uat cookies
  • Add host validation guard to harden proxy
Test plan
  •  Added test verifying multiple Set-Cookie headers are preserved through the proxy (using response.headers.getSetCookie())
  •  Added test verifying protocol-relative SSRF paths are rejected with 400 before any fetch is made
  •  All 38 existing proxy tests continue to pass
🤖 Generated with Claude Code
Summary by CodeRabbit
  • Bug Fixes
    • Proxy now preserves and forwards multiple Set-Cookie headers from upstream to clients.
  • Security
    • Requests that resolve to a host different from the expected frontend API host are rejected with a 400 error.
  • Tests
    • Added tests covering Set-Cookie preservation and rejection of ambiguous/malicious proxy target resolutions.
@changeset-bot
changeset-botBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 21a5805
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendPatch
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8162

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8162

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8162

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8162

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8162

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8162

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8162

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8162

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8162

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8162

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8162

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8162

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8162

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8162

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8162

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8162

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8162

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8162

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8162

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8162

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8162

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8162

commit: 21a5805
@jacekradko
jacekradko
commented
Mar 25, 2026

Copy link


Copy Markdown

Contributor
Classic headers issue!
@coderabbitai
coderabbitaiBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3588d8fb-ac85-4b06-ad15-e87add47b135
📥 Commits
Reviewing files that changed from the base of the PR and between 1883b8f and 21a5805.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
📝 Walkthrough
Walkthrough
Adds a changeset for a patch release to `@clerk/backend`. Implements an SSRF guard by deriving the expected frontend API host from `fapiBaseUrl` and rejecting proxied requests whose resolved `targetUrl.host` differs with a 400 `proxy_request_failed` JSON error. Adjusts proxy response handling to append upstream `Set-Cookie` headers (preserving multiple cookies) while setting other headers normally. Adds tests for ambiguous/protocol-relative target URLs and preservation of multiple `Set-Cookie` headers.
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and directly describes the main change: preserving Set-Cookie headers through the proxy, which is the core fix addressing the OAuth callback failures mentioned in the PR objectives.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brkalow@claude
fix(backend): preserve Set-Cookie headers and block SSRF in proxy
f390667
Use `headers.append()` instead of `headers.set()` for `set-cookie`
headers when copying FAPI response headers, preventing multiple
Set-Cookie values from being silently dropped (which caused OAuth
callback failures due to missing `__client` cookies).
Also add a host validation guard to prevent SSRF via protocol-relative
paths (e.g., `//evil.com/steal`) that would cause the URL constructor
to resolve to an attacker-controlled host, leaking the secret key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@brkalowbrkalow
changed the title
fix(backend): Append set-cookie headers in frontend proxyfix(backend): preserve Set-Cookie headers and block SSRF in proxyMar 25, 2026
@vercel
vercelBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentMar 25, 2026 6:26pm
Request Review
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

jacekradko
jacekradko
approved these changes
Mar 25, 2026
View reviewed changes
@jacekradkojacekradko
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Good catch
@brkalow@claude
fix(backend): use string concatenation for FAPI URL to prevent SSRF b…
1883b8f
…y construction
Replace `new URL(path, base)` with string concatenation so that
protocol-relative paths like `//evil.com` can never change the host.
The defense-in-depth host check is kept as a belt-and-suspenders guard.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jacekradko
jacekradko
reviewed
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
coderabbitai[bot]
coderabbitaiBot
reviewed
Mar 25, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/proxy.ts`:
- Around line 295-302: The bridge currently forwards response headers using
response.setHeader in the authenticateRequest flow which overwrites repeated
Set-Cookie values; update the header-forwarding loop in authenticateRequest (the
code that iterates response.headers and calls response.setHeader(key, value)) to
use response.appendHeader(key, value) for headers that may repeat (particularly
'set-cookie'), matching the approach used elsewhere (responseHeaders.append in
proxy.ts and the response.appendHeader call at line ~69), so multiple cookies
are preserved when sent to the client.

ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 79a73bb2-ec07-4aa9-8ca1-0967c86d9033
📥 Commits
Reviewing files that changed from the base of the PR and between 148923a and 1883b8f.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
Comment threadpackages/backend/src/proxy.ts
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

@brkalowbrkalow
changed the title
fix(backend): preserve Set-Cookie headers and block SSRF in proxyfix(backend): preserve Set-Cookie headers through proxyMar 25, 2026
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/__tests__/proxy.test.ts
Outdated

@brkalow
brkalow
merged commit 486545c
into
mainMar 25, 2026

44 checks passed

@brkalow
brkalow
deleted the

brkalow/fix-set-cookie-proxy

branch
March 25, 2026 18:35
@clerk-cookieclerk-cookie
mentioned this pull request
Mar 25, 2026
 Merged

wobsoriano pushed a commit
that referenced
this pull request
Mar 26, 2026
@brkalow@claude@wobsoriano
fix(backend): preserve Set-Cookie headers through proxy (#8162)
419da0f
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@jacekradkojacekradko
mentioned this pull request
Mar 26, 2026
 Merged

5 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments

+1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backend

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brkalow@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
fix(backend): preserve Set-Cookie headers through proxy by brkalow · Pull Request #8162 · clerk/javascript · GitHub
Skip to content
fix(backend): preserve Set-Cookie headers through proxy - #8162
Merged
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Mar 25, 2026
Merged
fix(backend): preserve Set-Cookie headers through proxy#8162
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Conversation
@brkalow
@brkalowbrkalow
commented
Mar 25, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • Use headers.append() instead of headers.set() for set-cookie response headers in clerkFrontendApiProxy, fixing OAuth callback failures caused by dropped __client / __client_uat cookies
  • Add host validation guard to harden proxy
Test plan
  •  Added test verifying multiple Set-Cookie headers are preserved through the proxy (using response.headers.getSetCookie())
  •  Added test verifying protocol-relative SSRF paths are rejected with 400 before any fetch is made
  •  All 38 existing proxy tests continue to pass
🤖 Generated with Claude Code
Summary by CodeRabbit
  • Bug Fixes
    • Proxy now preserves and forwards multiple Set-Cookie headers from upstream to clients.
  • Security
    • Requests that resolve to a host different from the expected frontend API host are rejected with a 400 error.
  • Tests
    • Added tests covering Set-Cookie preservation and rejection of ambiguous/malicious proxy target resolutions.
@changeset-bot
changeset-botBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 21a5805
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendPatch
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8162

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8162

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8162

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8162

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8162

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8162

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8162

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8162

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8162

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8162

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8162

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8162

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8162

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8162

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8162

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8162

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8162

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8162

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8162

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8162

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8162

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8162

commit: 21a5805
@jacekradko
jacekradko
commented
Mar 25, 2026

Copy link


Copy Markdown

Contributor
Classic headers issue!
@coderabbitai
coderabbitaiBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3588d8fb-ac85-4b06-ad15-e87add47b135
📥 Commits
Reviewing files that changed from the base of the PR and between 1883b8f and 21a5805.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
📝 Walkthrough
Walkthrough
Adds a changeset for a patch release to `@clerk/backend`. Implements an SSRF guard by deriving the expected frontend API host from `fapiBaseUrl` and rejecting proxied requests whose resolved `targetUrl.host` differs with a 400 `proxy_request_failed` JSON error. Adjusts proxy response handling to append upstream `Set-Cookie` headers (preserving multiple cookies) while setting other headers normally. Adds tests for ambiguous/protocol-relative target URLs and preservation of multiple `Set-Cookie` headers.
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and directly describes the main change: preserving Set-Cookie headers through the proxy, which is the core fix addressing the OAuth callback failures mentioned in the PR objectives.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brkalow@claude
fix(backend): preserve Set-Cookie headers and block SSRF in proxy
f390667
Use `headers.append()` instead of `headers.set()` for `set-cookie`
headers when copying FAPI response headers, preventing multiple
Set-Cookie values from being silently dropped (which caused OAuth
callback failures due to missing `__client` cookies).
Also add a host validation guard to prevent SSRF via protocol-relative
paths (e.g., `//evil.com/steal`) that would cause the URL constructor
to resolve to an attacker-controlled host, leaking the secret key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@brkalowbrkalow
changed the title
fix(backend): Append set-cookie headers in frontend proxyfix(backend): preserve Set-Cookie headers and block SSRF in proxyMar 25, 2026
@vercel
vercelBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentMar 25, 2026 6:26pm
Request Review
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

jacekradko
jacekradko
approved these changes
Mar 25, 2026
View reviewed changes
@jacekradkojacekradko
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Good catch
@brkalow@claude
fix(backend): use string concatenation for FAPI URL to prevent SSRF b…
1883b8f
…y construction
Replace `new URL(path, base)` with string concatenation so that
protocol-relative paths like `//evil.com` can never change the host.
The defense-in-depth host check is kept as a belt-and-suspenders guard.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jacekradko
jacekradko
reviewed
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
coderabbitai[bot]
coderabbitaiBot
reviewed
Mar 25, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/proxy.ts`:
- Around line 295-302: The bridge currently forwards response headers using
response.setHeader in the authenticateRequest flow which overwrites repeated
Set-Cookie values; update the header-forwarding loop in authenticateRequest (the
code that iterates response.headers and calls response.setHeader(key, value)) to
use response.appendHeader(key, value) for headers that may repeat (particularly
'set-cookie'), matching the approach used elsewhere (responseHeaders.append in
proxy.ts and the response.appendHeader call at line ~69), so multiple cookies
are preserved when sent to the client.

ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 79a73bb2-ec07-4aa9-8ca1-0967c86d9033
📥 Commits
Reviewing files that changed from the base of the PR and between 148923a and 1883b8f.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
Comment threadpackages/backend/src/proxy.ts
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

@brkalowbrkalow
changed the title
fix(backend): preserve Set-Cookie headers and block SSRF in proxyfix(backend): preserve Set-Cookie headers through proxyMar 25, 2026
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/__tests__/proxy.test.ts
Outdated

@brkalow
brkalow
merged commit 486545c
into
mainMar 25, 2026

44 checks passed

@brkalow
brkalow
deleted the

brkalow/fix-set-cookie-proxy

branch
March 25, 2026 18:35
@clerk-cookieclerk-cookie
mentioned this pull request
Mar 25, 2026
 Merged

wobsoriano pushed a commit
that referenced
this pull request
Mar 26, 2026
@brkalow@claude@wobsoriano
fix(backend): preserve Set-Cookie headers through proxy (#8162)
419da0f
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@jacekradkojacekradko
mentioned this pull request
Mar 26, 2026
 Merged

5 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments

+1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backend

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brkalow@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(backend): preserve Set-Cookie headers through proxy by brkalow · Pull Request #8162 · clerk/javascript · GitHub
Skip to content
fix(backend): preserve Set-Cookie headers through proxy - #8162
Merged
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Mar 25, 2026
Merged
fix(backend): preserve Set-Cookie headers through proxy#8162
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Conversation
@brkalow
@brkalowbrkalow
commented
Mar 25, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • Use headers.append() instead of headers.set() for set-cookie response headers in clerkFrontendApiProxy, fixing OAuth callback failures caused by dropped __client / __client_uat cookies
  • Add host validation guard to harden proxy
Test plan
  •  Added test verifying multiple Set-Cookie headers are preserved through the proxy (using response.headers.getSetCookie())
  •  Added test verifying protocol-relative SSRF paths are rejected with 400 before any fetch is made
  •  All 38 existing proxy tests continue to pass
🤖 Generated with Claude Code
Summary by CodeRabbit
  • Bug Fixes
    • Proxy now preserves and forwards multiple Set-Cookie headers from upstream to clients.
  • Security
    • Requests that resolve to a host different from the expected frontend API host are rejected with a 400 error.
  • Tests
    • Added tests covering Set-Cookie preservation and rejection of ambiguous/malicious proxy target resolutions.
@changeset-bot
changeset-botBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 21a5805
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendPatch
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8162

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8162

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8162

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8162

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8162

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8162

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8162

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8162

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8162

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8162

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8162

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8162

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8162

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8162

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8162

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8162

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8162

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8162

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8162

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8162

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8162

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8162

commit: 21a5805
@jacekradko
jacekradko
commented
Mar 25, 2026

Copy link


Copy Markdown

Contributor
Classic headers issue!
@coderabbitai
coderabbitaiBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3588d8fb-ac85-4b06-ad15-e87add47b135
📥 Commits
Reviewing files that changed from the base of the PR and between 1883b8f and 21a5805.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
📝 Walkthrough
Walkthrough
Adds a changeset for a patch release to `@clerk/backend`. Implements an SSRF guard by deriving the expected frontend API host from `fapiBaseUrl` and rejecting proxied requests whose resolved `targetUrl.host` differs with a 400 `proxy_request_failed` JSON error. Adjusts proxy response handling to append upstream `Set-Cookie` headers (preserving multiple cookies) while setting other headers normally. Adds tests for ambiguous/protocol-relative target URLs and preservation of multiple `Set-Cookie` headers.
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and directly describes the main change: preserving Set-Cookie headers through the proxy, which is the core fix addressing the OAuth callback failures mentioned in the PR objectives.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brkalow@claude
fix(backend): preserve Set-Cookie headers and block SSRF in proxy
f390667
Use `headers.append()` instead of `headers.set()` for `set-cookie`
headers when copying FAPI response headers, preventing multiple
Set-Cookie values from being silently dropped (which caused OAuth
callback failures due to missing `__client` cookies).
Also add a host validation guard to prevent SSRF via protocol-relative
paths (e.g., `//evil.com/steal`) that would cause the URL constructor
to resolve to an attacker-controlled host, leaking the secret key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@brkalowbrkalow
changed the title
fix(backend): Append set-cookie headers in frontend proxyfix(backend): preserve Set-Cookie headers and block SSRF in proxyMar 25, 2026
@vercel
vercelBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentMar 25, 2026 6:26pm
Request Review
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

jacekradko
jacekradko
approved these changes
Mar 25, 2026
View reviewed changes
@jacekradkojacekradko
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Good catch
@brkalow@claude
fix(backend): use string concatenation for FAPI URL to prevent SSRF b…
1883b8f
…y construction
Replace `new URL(path, base)` with string concatenation so that
protocol-relative paths like `//evil.com` can never change the host.
The defense-in-depth host check is kept as a belt-and-suspenders guard.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jacekradko
jacekradko
reviewed
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
coderabbitai[bot]
coderabbitaiBot
reviewed
Mar 25, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/proxy.ts`:
- Around line 295-302: The bridge currently forwards response headers using
response.setHeader in the authenticateRequest flow which overwrites repeated
Set-Cookie values; update the header-forwarding loop in authenticateRequest (the
code that iterates response.headers and calls response.setHeader(key, value)) to
use response.appendHeader(key, value) for headers that may repeat (particularly
'set-cookie'), matching the approach used elsewhere (responseHeaders.append in
proxy.ts and the response.appendHeader call at line ~69), so multiple cookies
are preserved when sent to the client.

ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 79a73bb2-ec07-4aa9-8ca1-0967c86d9033
📥 Commits
Reviewing files that changed from the base of the PR and between 148923a and 1883b8f.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
Comment threadpackages/backend/src/proxy.ts
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

@brkalowbrkalow
changed the title
fix(backend): preserve Set-Cookie headers and block SSRF in proxyfix(backend): preserve Set-Cookie headers through proxyMar 25, 2026
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/__tests__/proxy.test.ts
Outdated

@brkalow
brkalow
merged commit 486545c
into
mainMar 25, 2026

44 checks passed

@brkalow
brkalow
deleted the

brkalow/fix-set-cookie-proxy

branch
March 25, 2026 18:35
@clerk-cookieclerk-cookie
mentioned this pull request
Mar 25, 2026
 Merged

wobsoriano pushed a commit
that referenced
this pull request
Mar 26, 2026
@brkalow@claude@wobsoriano
fix(backend): preserve Set-Cookie headers through proxy (#8162)
419da0f
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@jacekradkojacekradko
mentioned this pull request
Mar 26, 2026
 Merged

5 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments

+1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backend

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brkalow@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
fix(backend): preserve Set-Cookie headers through proxy by brkalow · Pull Request #8162 · clerk/javascript · GitHub
Skip to content
fix(backend): preserve Set-Cookie headers through proxy - #8162
Merged
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Mar 25, 2026
Merged
fix(backend): preserve Set-Cookie headers through proxy#8162
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Conversation
@brkalow
@brkalowbrkalow
commented
Mar 25, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • Use headers.append() instead of headers.set() for set-cookie response headers in clerkFrontendApiProxy, fixing OAuth callback failures caused by dropped __client / __client_uat cookies
  • Add host validation guard to harden proxy
Test plan
  •  Added test verifying multiple Set-Cookie headers are preserved through the proxy (using response.headers.getSetCookie())
  •  Added test verifying protocol-relative SSRF paths are rejected with 400 before any fetch is made
  •  All 38 existing proxy tests continue to pass
🤖 Generated with Claude Code
Summary by CodeRabbit
  • Bug Fixes
    • Proxy now preserves and forwards multiple Set-Cookie headers from upstream to clients.
  • Security
    • Requests that resolve to a host different from the expected frontend API host are rejected with a 400 error.
  • Tests
    • Added tests covering Set-Cookie preservation and rejection of ambiguous/malicious proxy target resolutions.
@changeset-bot
changeset-botBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 21a5805
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendPatch
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8162

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8162

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8162

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8162

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8162

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8162

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8162

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8162

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8162

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8162

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8162

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8162

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8162

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8162

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8162

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8162

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8162

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8162

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8162

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8162

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8162

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8162

commit: 21a5805
@jacekradko
jacekradko
commented
Mar 25, 2026

Copy link


Copy Markdown

Contributor
Classic headers issue!
@coderabbitai
coderabbitaiBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3588d8fb-ac85-4b06-ad15-e87add47b135
📥 Commits
Reviewing files that changed from the base of the PR and between 1883b8f and 21a5805.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
📝 Walkthrough
Walkthrough
Adds a changeset for a patch release to `@clerk/backend`. Implements an SSRF guard by deriving the expected frontend API host from `fapiBaseUrl` and rejecting proxied requests whose resolved `targetUrl.host` differs with a 400 `proxy_request_failed` JSON error. Adjusts proxy response handling to append upstream `Set-Cookie` headers (preserving multiple cookies) while setting other headers normally. Adds tests for ambiguous/protocol-relative target URLs and preservation of multiple `Set-Cookie` headers.
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and directly describes the main change: preserving Set-Cookie headers through the proxy, which is the core fix addressing the OAuth callback failures mentioned in the PR objectives.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brkalow@claude
fix(backend): preserve Set-Cookie headers and block SSRF in proxy
f390667
Use `headers.append()` instead of `headers.set()` for `set-cookie`
headers when copying FAPI response headers, preventing multiple
Set-Cookie values from being silently dropped (which caused OAuth
callback failures due to missing `__client` cookies).
Also add a host validation guard to prevent SSRF via protocol-relative
paths (e.g., `//evil.com/steal`) that would cause the URL constructor
to resolve to an attacker-controlled host, leaking the secret key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@brkalowbrkalow
changed the title
fix(backend): Append set-cookie headers in frontend proxyfix(backend): preserve Set-Cookie headers and block SSRF in proxyMar 25, 2026
@vercel
vercelBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentMar 25, 2026 6:26pm
Request Review
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

jacekradko
jacekradko
approved these changes
Mar 25, 2026
View reviewed changes
@jacekradkojacekradko
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Good catch
@brkalow@claude
fix(backend): use string concatenation for FAPI URL to prevent SSRF b…
1883b8f
…y construction
Replace `new URL(path, base)` with string concatenation so that
protocol-relative paths like `//evil.com` can never change the host.
The defense-in-depth host check is kept as a belt-and-suspenders guard.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jacekradko
jacekradko
reviewed
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
coderabbitai[bot]
coderabbitaiBot
reviewed
Mar 25, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/proxy.ts`:
- Around line 295-302: The bridge currently forwards response headers using
response.setHeader in the authenticateRequest flow which overwrites repeated
Set-Cookie values; update the header-forwarding loop in authenticateRequest (the
code that iterates response.headers and calls response.setHeader(key, value)) to
use response.appendHeader(key, value) for headers that may repeat (particularly
'set-cookie'), matching the approach used elsewhere (responseHeaders.append in
proxy.ts and the response.appendHeader call at line ~69), so multiple cookies
are preserved when sent to the client.

ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 79a73bb2-ec07-4aa9-8ca1-0967c86d9033
📥 Commits
Reviewing files that changed from the base of the PR and between 148923a and 1883b8f.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
Comment threadpackages/backend/src/proxy.ts
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

@brkalowbrkalow
changed the title
fix(backend): preserve Set-Cookie headers and block SSRF in proxyfix(backend): preserve Set-Cookie headers through proxyMar 25, 2026
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/__tests__/proxy.test.ts
Outdated

@brkalow
brkalow
merged commit 486545c
into
mainMar 25, 2026

44 checks passed

@brkalow
brkalow
deleted the

brkalow/fix-set-cookie-proxy

branch
March 25, 2026 18:35
@clerk-cookieclerk-cookie
mentioned this pull request
Mar 25, 2026
 Merged

wobsoriano pushed a commit
that referenced
this pull request
Mar 26, 2026
@brkalow@claude@wobsoriano
fix(backend): preserve Set-Cookie headers through proxy (#8162)
419da0f
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@jacekradkojacekradko
mentioned this pull request
Mar 26, 2026
 Merged

5 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments

+1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backend

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brkalow@jacekradko

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();
fix(backend): preserve Set-Cookie headers through proxy by brkalow · Pull Request #8162 · clerk/javascript · GitHub
Skip to content
fix(backend): preserve Set-Cookie headers through proxy - #8162
Merged
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Mar 25, 2026
Merged
fix(backend): preserve Set-Cookie headers through proxy#8162
brkalow merged 6 commits into
mainfrom 
brkalow/fix-set-cookie-proxy
Conversation
@brkalow
@brkalowbrkalow
commented
Mar 25, 2026•

edited by coderabbitai
Bot
Loading

Copy link


Copy Markdown

Member
Summary
  • Use headers.append() instead of headers.set() for set-cookie response headers in clerkFrontendApiProxy, fixing OAuth callback failures caused by dropped __client / __client_uat cookies
  • Add host validation guard to harden proxy
Test plan
  •  Added test verifying multiple Set-Cookie headers are preserved through the proxy (using response.headers.getSetCookie())
  •  Added test verifying protocol-relative SSRF paths are rejected with 400 before any fetch is made
  •  All 38 existing proxy tests continue to pass
🤖 Generated with Claude Code
Summary by CodeRabbit
  • Bug Fixes
    • Proxy now preserves and forwards multiple Set-Cookie headers from upstream to clients.
  • Security
    • Requests that resolve to a host different from the expected frontend API host are rejected with a 400 error.
  • Tests
    • Added tests covering Set-Cookie preservation and rejection of ambiguous/malicious proxy target resolutions.
@changeset-bot
changeset-botBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

🦋 Changeset detected
Latest commit: 21a5805
The changes in this PR will be included in the next version bump.
This PR includes changesets to release 11 packages
NameType
@clerk/backendPatch
@clerk/agent-toolkitPatch
@clerk/astroPatch
@clerk/expressPatch
@clerk/fastifyPatch
@clerk/honoPatch
@clerk/nextjsPatch
@clerk/nuxtPatch
@clerk/react-routerPatch
@clerk/tanstack-react-startPatch
@clerk/testingPatch
Not sure what this means? Click here to learn what changesets are.
Click here if you're a maintainer who wants to add another changeset to this PR
@pkg-pr-new
pkg-pr-newBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Open in StackBlitz
@clerk/agent-toolkit
npm i https://pkg.pr.new/@clerk/agent-toolkit@8162

@clerk/astro
npm i https://pkg.pr.new/@clerk/astro@8162

@clerk/backend
npm i https://pkg.pr.new/@clerk/backend@8162

@clerk/chrome-extension
npm i https://pkg.pr.new/@clerk/chrome-extension@8162

@clerk/clerk-js
npm i https://pkg.pr.new/@clerk/clerk-js@8162

@clerk/dev-cli
npm i https://pkg.pr.new/@clerk/dev-cli@8162

@clerk/expo
npm i https://pkg.pr.new/@clerk/expo@8162

@clerk/expo-passkeys
npm i https://pkg.pr.new/@clerk/expo-passkeys@8162

@clerk/express
npm i https://pkg.pr.new/@clerk/express@8162

@clerk/fastify
npm i https://pkg.pr.new/@clerk/fastify@8162

@clerk/hono
npm i https://pkg.pr.new/@clerk/hono@8162

@clerk/localizations
npm i https://pkg.pr.new/@clerk/localizations@8162

@clerk/nextjs
npm i https://pkg.pr.new/@clerk/nextjs@8162

@clerk/nuxt
npm i https://pkg.pr.new/@clerk/nuxt@8162

@clerk/react
npm i https://pkg.pr.new/@clerk/react@8162

@clerk/react-router
npm i https://pkg.pr.new/@clerk/react-router@8162

@clerk/shared
npm i https://pkg.pr.new/@clerk/shared@8162

@clerk/tanstack-react-start
npm i https://pkg.pr.new/@clerk/tanstack-react-start@8162

@clerk/testing
npm i https://pkg.pr.new/@clerk/testing@8162

@clerk/ui
npm i https://pkg.pr.new/@clerk/ui@8162

@clerk/upgrade
npm i https://pkg.pr.new/@clerk/upgrade@8162

@clerk/vue
npm i https://pkg.pr.new/@clerk/vue@8162

commit: 21a5805
@jacekradko
jacekradko
commented
Mar 25, 2026

Copy link


Copy Markdown

Contributor
Classic headers issue!
@coderabbitai
coderabbitaiBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

Contributor
Note
Reviews paused
It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.
Use the following commands to manage reviews:
  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.
Use the checkboxes below for quick actions:
  • ▶️ Resume reviews
  •  🔍 Trigger review
No actionable comments were generated in the recent review. 🎉
ℹ️ Recent review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 3588d8fb-ac85-4b06-ad15-e87add47b135
📥 Commits
Reviewing files that changed from the base of the PR and between 1883b8f and 21a5805.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
📝 Walkthrough
Walkthrough
Adds a changeset for a patch release to `@clerk/backend`. Implements an SSRF guard by deriving the expected frontend API host from `fapiBaseUrl` and rejecting proxied requests whose resolved `targetUrl.host` differs with a 400 `proxy_request_failed` JSON error. Adjusts proxy response handling to append upstream `Set-Cookie` headers (preserving multiple cookies) while setting other headers normally. Adds tests for ambiguous/protocol-relative target URLs and preservation of multiple `Set-Cookie` headers.
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check nameStatusExplanation
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
Title check✅ PassedThe title clearly and directly describes the main change: preserving Set-Cookie headers through the proxy, which is the core fix addressing the OAuth callback failures mentioned in the PR objectives.
Docstring Coverage✅ PassedDocstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
✏️ Tip: You can configure your own custom pre-merge checks in the settings.
Comment @coderabbitai help to get the list of available commands and usage tips.
@brkalow@claude
fix(backend): preserve Set-Cookie headers and block SSRF in proxy
f390667
Use `headers.append()` instead of `headers.set()` for `set-cookie`
headers when copying FAPI response headers, preventing multiple
Set-Cookie values from being silently dropped (which caused OAuth
callback failures due to missing `__client` cookies).
Also add a host validation guard to prevent SSRF via protocol-relative
paths (e.g., `//evil.com/steal`) that would cause the URL constructor
to resolve to an attacker-controlled host, leaking the secret key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@brkalowbrkalow
changed the title
fix(backend): Append set-cookie headers in frontend proxyfix(backend): preserve Set-Cookie headers and block SSRF in proxyMar 25, 2026
@vercel
vercelBot
commented
Mar 25, 2026•

edited

Loading

Copy link


Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.
ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentMar 25, 2026 6:26pm
Request Review
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

jacekradko
jacekradko
approved these changes
Mar 25, 2026
View reviewed changes
@jacekradkojacekradko
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes sense. Good catch
@brkalow@claude
fix(backend): use string concatenation for FAPI URL to prevent SSRF b…
1883b8f
…y construction
Replace `new URL(path, base)` with string concatenation so that
protocol-relative paths like `//evil.com` can never change the host.
The defense-in-depth host check is kept as a belt-and-suspenders guard.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
jacekradko
jacekradko
reviewed
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
coderabbitai[bot]
coderabbitaiBot
reviewed
Mar 25, 2026
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/backend/src/proxy.ts`:
- Around line 295-302: The bridge currently forwards response headers using
response.setHeader in the authenticateRequest flow which overwrites repeated
Set-Cookie values; update the header-forwarding loop in authenticateRequest (the
code that iterates response.headers and calls response.setHeader(key, value)) to
use response.appendHeader(key, value) for headers that may repeat (particularly
'set-cookie'), matching the approach used elsewhere (responseHeaders.append in
proxy.ts and the response.appendHeader call at line ~69), so multiple cookies
are preserved when sent to the client.

ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 79a73bb2-ec07-4aa9-8ca1-0967c86d9033
📥 Commits
Reviewing files that changed from the base of the PR and between 148923a and 1883b8f.
📒 Files selected for processing (2)
  • packages/backend/src/__tests__/proxy.test.ts
  • packages/backend/src/proxy.ts
Comment threadpackages/backend/src/proxy.ts
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/proxy.ts
Outdated

@brkalowbrkalow
changed the title
fix(backend): preserve Set-Cookie headers and block SSRF in proxyfix(backend): preserve Set-Cookie headers through proxyMar 25, 2026
brkalow
brkalow
commented
Mar 25, 2026
View reviewed changes
Comment threadpackages/backend/src/__tests__/proxy.test.ts
Outdated

@brkalow
brkalow
merged commit 486545c
into
mainMar 25, 2026

44 checks passed

@brkalow
brkalow
deleted the

brkalow/fix-set-cookie-proxy

branch
March 25, 2026 18:35
@clerk-cookieclerk-cookie
mentioned this pull request
Mar 25, 2026
 Merged

wobsoriano pushed a commit
that referenced
this pull request
Mar 26, 2026
@brkalow@claude@wobsoriano
fix(backend): preserve Set-Cookie headers through proxy (#8162)
419da0f
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
@jacekradkojacekradko
mentioned this pull request
Mar 26, 2026
 Merged

5 tasks
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments

+1 more reviewer

@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees


No one assigned


Labels

backend

Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brkalow@jacekradko