') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); fix(ui): scope active-devices cache by user to prevent cross-user leak by dominic-clerk · Pull Request #8703 · clerk/javascript · GitHub
Skip to content

fix(ui): scope active-devices cache by user to prevent cross-user leak - #8703

Merged
dominic-clerk merged 1 commit into
mainfrom
dc-ui-cache-fix
May 29, 2026
Merged

fix(ui): scope active-devices cache by user to prevent cross-user leak#8703
dominic-clerk merged 1 commit into
mainfrom
dc-ui-cache-fix

Conversation

@dominic-clerk

@dominic-clerkdominic-clerk commented May 29, 2026

Copy link
Copy Markdown
Contributor

Description

The UserProfile active-devices list was cached in a module-scoped fetch cache keyed only by a constant string, so a session switch or a sign-out/sign-in on a shared device could render the previous user's device activity (IP, location, browser/device). Key the cache by user.id.

Checklist

  • pnpm test runs as expected.
  • pnpm build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

@dominic-clerk@claude
fix(ui): scope active-devices cache by user to prevent cross-user leak
2312dcb
The UserProfile active-devices list was cached in a module-scoped fetch
cache keyed only by a constant string, so a session switch or a
sign-out/sign-in on a shared device could render the previous user's
device activity (IP, location, browser/device). Key the cache by user.id.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@changeset-bot

changeset-botBot commented May 29, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 2312dcb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages
NameType
@clerk/uiPatch
@clerk/chrome-extensionPatch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@vercel

vercelBot commented May 29, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

ProjectDeploymentActionsUpdated (UTC)
clerk-js-sandboxReadyReadyPreview, CommentMay 29, 2026 12:12pm

Request Review

@github-actions

github-actionsBot commented May 29, 2026

Copy link
Copy Markdown
Contributor

Snapi: no API changes detected in @clerk/backend, @clerk/clerk-js, @clerk/nextjs, @clerk/react, @clerk/shared, @clerk/ui.

@pkg-pr-new

pkg-pr-newBot commented May 29, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8703

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8703

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8703

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8703

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8703

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8703

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8703

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8703

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8703

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8703

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8703

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8703

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8703

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8703

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8703

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8703

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8703

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8703

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8703

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8703

commit: 2312dcb

@coderabbitai

coderabbitaiBot commented May 29, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: e1e9dc1e-b54e-41fe-84c0-88099cf0dbc6

📥 Commits

Reviewing files that changed from the base of the PR and between b9eb19d and 2312dcb.

📒 Files selected for processing (3)
  • .changeset/tangy-ducks-end.md
  • packages/ui/src/components/UserProfile/ActiveDevicesSection.tsx
  • packages/ui/src/components/UserProfile/__tests__/SecurityPage.test.tsx
📝 Walkthrough

Walkthrough

This PR fixes a caching issue in the UserProfile component where active-device session data was being shared across users due to module-level cache scoping. The fix updates the useFetch hook invocation in ActiveDevicesSection to include userId as an options parameter, ensuring the cache is keyed per user. A new test verifies that device activity from one user does not appear when rendering for another user. The changeset documents the patch release.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check nameStatusExplanation
Title check✅ PassedThe pull request title clearly and concisely summarizes the main change: fixing the active-devices cache by scoping it to user.id to prevent cross-user data leakage.
Description check✅ PassedThe pull request description is directly related to the changeset, explaining the caching issue and the solution of keying the cache by user.id.
Docstring Coverage✅ PassedNo functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check✅ PassedCheck skipped because no linked issues were found for this pull request.
Out of Scope Changes check✅ PassedCheck skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

jacekradko
jacekradko approved these changes May 29, 2026
View reviewed changes

@jacekradkojacekradko left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍🏼

@dominic-clerk
dominic-clerk merged commit a1d96f1 into mainMay 29, 2026
45 checks passed
@dominic-clerk
dominic-clerk deleted the dc-ui-cache-fix branch May 29, 2026 16:44
@clerk-cookieclerk-cookie mentioned this pull request May 29, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@jacekradkojacekradkojacekradko approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

ui

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@dominic-clerk@jacekradko