fix(clerk-js): validate window navigation protocols and honor allowedRedirectProtocols

.changeset/windownavigate-protocol-allowlist.md

@@ -0,0 +1,10 @@
+---
+'@clerk/clerk-js': patch
+'@clerk/react': patch
+'@clerk/shared': patch
+'@clerk/ui': patch
+---
+
+Fix missing redirect URL protocol validation for Clerk UI browser navigations, including the multi-session add-account flow.
+
+Internal browser navigations now consistently honor configured redirect protocols and fail closed across mixed ClerkJS/UI bundle versions.

packages/clerk-js/bundlewatch.config.json

@@ -2,9 +2,9 @@
  "files": [
  { "path": "./dist/clerk.js", "maxSize": "549KB" },
  { "path": "./dist/clerk.browser.js", "maxSize": "74KB" },
- { "path": "./dist/clerk.legacy.browser.js", "maxSize": "115KB" },
+ { "path": "./dist/clerk.legacy.browser.js", "maxSize": "116KB" },
  { "path": "./dist/clerk.no-rhc.js", "maxSize": "316KB" },
- { "path": "./dist/clerk.native.js", "maxSize": "73KB" },
+ { "path": "./dist/clerk.native.js", "maxSize": "74KB" },
  { "path": "./dist/vendors*.js", "maxSize": "7KB" },
  { "path": "./dist/coinbase*.js", "maxSize": "36KB" },
  { "path": "./dist/base-account-sdk*.js", "maxSize": "207KB" },

packages/clerk-js/src/core/clerk.ts

@@ -1916,7 +1916,7 @@ export class Clerk implements ClerkInterface {
 
  if (customNavigate) {
  debugLogger.info(`Clerk is navigating to: ${to}`);
- return await customNavigate(to, { windowNavigate });
+ return await customNavigate(to, { windowNavigate: this.__internal_windowNavigate });
  }
 
  // No window.location and no custom router - can't navigate
@@ -1955,13 +1955,13 @@ export class Clerk implements ClerkInterface {
 
  // Custom protocol URLs have an origin value of 'null'. In many cases, this indicates deep-linking and we want to ensure the customNavigate function is used if available.
  if ((toURL.origin !== 'null' && toURL.origin !== window.location.origin) || !customNavigate) {
-windowNavigate(toURL);
+this.__internal_windowNavigate(toURL);
  return;
  }
 
  const metadata = {
  ...(options?.metadata ? { __internal_metadata: options?.metadata } : {}),
- windowNavigate,
+ windowNavigate: this.__internal_windowNavigate,
  };
  // React router only wants the path, search or hash portion.
  return await customNavigate(stripOrigin(toURL), metadata);
@@ -3578,6 +3578,21 @@ export class Clerk implements ClerkInterface {
  return allowedProtocols;
  }
 
+ /**
+ * Primary `window.location.href` navigation chokepoint for `@clerk/clerk-js` and `@clerk/ui`.
+ * By default the resolved URL is validated against the customer-supplied
+ * `allowedRedirectProtocols` option (the static `ALLOWED_PROTOCOLS` ∪ the customer extension),
+ * so internal callers honor customer protocols automatically.
+ *
+ * Pass `useStaticAllowlistOnly: true` to opt out of the customer extension when a call site
+ * must reject any protocol the customer added. There is no current internal consumer of the
+ * opt-out; it exists for future security-critical paths.
+ */
+ public __internal_windowNavigate = (to: URL | string, opts?: { useStaticAllowlistOnly?: boolean }): void => {
+ const allowedProtocols = opts?.useStaticAllowlistOnly ? ALLOWED_PROTOCOLS : this.#allowedRedirectProtocols;
+ windowNavigate(to, { allowedProtocols });
+ };
+
  #isLoaded(): this is LoadedClerk {
  return this.client !== undefined;
  }

packages/clerk-js/src/core/resources/SignIn.ts

@@ -7,7 +7,6 @@ import {
 } from '@clerk/shared/internal/clerk-js/passkeys';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
 import { getClerkQueryParam } from '@clerk/shared/internal/clerk-js/queryParams';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptFirstFactorParams,
@@ -392,7 +391,7 @@ export class SignIn extends BaseResource implements SignInResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignIn.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (params: AuthenticateWithPopupParams): Promise<void> => {
@@ -1199,7 +1198,7 @@ class SignInFuture implements SignInFutureResource {
  // Pick up the modified SignIn resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignIn.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/clerk-js/src/core/resources/SignUp.ts

@@ -1,7 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { type ClerkError, ClerkRuntimeError, isCaptchaError, isClerkAPIResponseError } from '@clerk/shared/error';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptEmailAddressVerificationParams,
@@ -462,7 +461,7 @@ export class SignUp extends BaseResource implements SignUpResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignUp.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (
@@ -1082,7 +1081,7 @@ class SignUpFuture implements SignUpFutureResource {
  // Pick up the modified SignUp resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignUp.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -434,4 +434,94 @@ describe('isomorphicClerk', () => {
  );
  });
  });
+
+ describe('__internal_windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ });
+
+ afterEach(() => {
+ Object.defineProperty(window, 'location', { configurable: true, value: originalLocation });
+ warnSpy.mockRestore();
+ });
+
+ it('delegates to clerk-js when the navigation chokepoint is available', () => {
+ const navigate = vi.fn();
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = { __internal_windowNavigate: navigate };
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in', { useStaticAllowlistOnly: true });
+
+ expect(navigate).toHaveBeenCalledWith('/sign-in', { useStaticAllowlistOnly: true });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ });
+
+ it('falls back to navigation when clerk-js is older and lacks the chokepoint', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ // An older clerk-js that does not expose __internal_windowNavigate.
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in');
+
+ expect(hrefSetter).toHaveBeenCalledWith('https://example.com/sign-in');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback honors the customer-supplied allowedRedirectProtocols option', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123');
+
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback fails closed for disallowed protocols', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('javascript:alert(1)');
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('fallback ignores customer protocols when useStaticAllowlistOnly is set', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123', { useStaticAllowlistOnly: true });
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+ });
 });

packages/react/src/isomorphicClerk.ts

@@ -1,5 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { clerkEvents, createClerkEventBus } from '@clerk/shared/clerkEventBus';
+import { ALLOWED_PROTOCOLS, windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { loadClerkJSScript, loadClerkUIScript } from '@clerk/shared/loadClerkJsScript';
 import type {
  __internal_AttemptToEnableEnvironmentSettingParams,
@@ -265,6 +266,25 @@ export class IsomorphicClerk implements IsomorphicLoadedClerk {
  return this.clerkjs?.__internal_getOption ? this.clerkjs?.__internal_getOption(key) : this.options[key];
  }
 
+ public __internal_windowNavigate: Clerk['__internal_windowNavigate'] = (to, opts) => {
+ const clerkjs = this.clerkjs;
+ if (typeof clerkjs?.__internal_windowNavigate === 'function') {
+ clerkjs.__internal_windowNavigate(to, opts);
+ return;
+ }
+
+ // Older clerk-js lacks this navigation chokepoint, so delegating would silently no-op. Fall back to
+ // the shared helper (browser-only, it touches window.location) so newer @clerk/ui still navigates and
+ // rejects disallowed protocols on an older clerk-js, honoring allowedRedirectProtocols unless opted out.
+ if (!inBrowser()) {
+ return;
+ }
+ const allowedProtocols = opts?.useStaticAllowlistOnly
+ ? ALLOWED_PROTOCOLS
+ : [...ALLOWED_PROTOCOLS, ...(this.options.allowedRedirectProtocols ?? [])];
+ windowNavigate(to, { allowedProtocols });
+ };
+
  constructor(options: IsomorphicClerkOptions) {
  this.#publishableKey = options?.publishableKey;
  this.#proxyUrl = options?.proxyUrl;

packages/shared/src/internal/clerk-js/__tests__/windowNavigate.test.ts

@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { ALLOWED_PROTOCOLS, CLERK_BEFORE_UNLOAD_EVENT, windowNavigate } from '../windowNavigate';
+
+describe('windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+ let eventSpy: ReturnType<typeof vi.fn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ (target as any).href = value;
+ return true;
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ eventSpy = vi.fn();
+ window.addEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ });
+
+ afterEach(() => {
+ window.removeEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: originalLocation,
+ });
+ warnSpy.mockRestore();
+ });
+
+ it.each([
+ ['absolute https URL', 'https://example.com/dashboard'],
+ ['absolute http URL', 'http://example.com/dashboard'],
+ ['relative path', '/sign-in'],
+ ['wails protocol', 'wails://app/route'],
+ ['chrome-extension protocol', 'chrome-extension://abc/route'],
+ ])('navigates to %s', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it.each([
+ ['javascript', 'javascript:alert(1)'],
+ ['data', 'data:text/html,<script>alert(1)</script>'],
+ ['file', 'file:///etc/passwd'],
+ ['vbscript', 'vbscript:msgbox(1)'],
+ ['mixed-case JavaScript', 'JavaScript:alert(1)'],
+ ['upper-case JAVASCRIPT', 'JAVASCRIPT:alert(1)'],
+ ['leading-whitespace javascript', ' javascript:alert(1)'],
+ ['leading-tab javascript', '\tjavascript:alert(1)'],
+ ['leading-newline javascript', '\njavascript:alert(1)'],
+ ])('blocks %s: protocol and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('blocks javascript: URLs that the URL parser normalizes via the base URL', () => {
+ windowNavigate('javascript:alert(location.origin)//');
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it.each([
+ ['scheme-relative //host', '//evil.example/path'],
+ ['scheme-relative ///host', '///evil.example/path'],
+ ['backslash \\\\host', '\\\\evil.example\\path'],
+ ['mixed /\\host', '/\\evil.example/path'],
+ ['mixed \\/host', '\\/evil.example/path'],
+ ['leading-whitespace scheme-relative', ' //evil.example/path'],
+ ['leading-tab scheme-relative', '\t//evil.example/path'],
+ // Control characters the URL parser strips but `trim()` does not: each still resolves
+ // scheme-relative against the base origin, so the guard must normalize before testing.
+ ['interior-tab scheme-relative', '/\t/evil.example/path'],
+ ['interior-newline scheme-relative', '/\n/evil.example/path'],
+ ['interior-cr scheme-relative', '/\r/evil.example/path'],
+ ['interior-tab backslash', '\\\t\\evil.example/path'],
+ ['leading-null scheme-relative', '\x00//evil.example/path'],
+ ['leading-c0-controls scheme-relative', '\x01\x02//evil.example/path'],
+ ])('blocks %s and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('still rejects scheme-relative URLs when an extended allowlist is supplied', () => {
+ windowNavigate('//evil.example/path', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('honors a caller-supplied extended allowlist for custom protocols', () => {
+ windowNavigate('slack://channel/123', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('still rejects disallowed protocols when an extended allowlist is supplied', () => {
+ windowNavigate('javascript:alert(1)', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+});

.changeset/windownavigate-protocol-allowlist.md

@@ -0,0 +1,10 @@
+---
+'@clerk/clerk-js': patch
+'@clerk/react': patch
+'@clerk/shared': patch
+'@clerk/ui': patch
+---
+
+Fix missing redirect URL protocol validation for Clerk UI browser navigations, including the multi-session add-account flow.
+
+Internal browser navigations now consistently honor configured redirect protocols and fail closed across mixed ClerkJS/UI bundle versions.

packages/clerk-js/bundlewatch.config.json

@@ -2,9 +2,9 @@
  "files": [
  { "path": "./dist/clerk.js", "maxSize": "549KB" },
  { "path": "./dist/clerk.browser.js", "maxSize": "74KB" },
- { "path": "./dist/clerk.legacy.browser.js", "maxSize": "115KB" },
+ { "path": "./dist/clerk.legacy.browser.js", "maxSize": "116KB" },
  { "path": "./dist/clerk.no-rhc.js", "maxSize": "316KB" },
- { "path": "./dist/clerk.native.js", "maxSize": "73KB" },
+ { "path": "./dist/clerk.native.js", "maxSize": "74KB" },
  { "path": "./dist/vendors*.js", "maxSize": "7KB" },
  { "path": "./dist/coinbase*.js", "maxSize": "36KB" },
  { "path": "./dist/base-account-sdk*.js", "maxSize": "207KB" },

packages/clerk-js/src/core/clerk.ts

@@ -1916,7 +1916,7 @@ export class Clerk implements ClerkInterface {
 
  if (customNavigate) {
  debugLogger.info(`Clerk is navigating to: ${to}`);
- return await customNavigate(to, { windowNavigate });
+ return await customNavigate(to, { windowNavigate: this.__internal_windowNavigate });
  }
 
  // No window.location and no custom router - can't navigate
@@ -1955,13 +1955,13 @@ export class Clerk implements ClerkInterface {
 
  // Custom protocol URLs have an origin value of 'null'. In many cases, this indicates deep-linking and we want to ensure the customNavigate function is used if available.
  if ((toURL.origin !== 'null' && toURL.origin !== window.location.origin) || !customNavigate) {
-windowNavigate(toURL);
+this.__internal_windowNavigate(toURL);
  return;
  }
 
  const metadata = {
  ...(options?.metadata ? { __internal_metadata: options?.metadata } : {}),
- windowNavigate,
+ windowNavigate: this.__internal_windowNavigate,
  };
  // React router only wants the path, search or hash portion.
  return await customNavigate(stripOrigin(toURL), metadata);
@@ -3578,6 +3578,21 @@ export class Clerk implements ClerkInterface {
  return allowedProtocols;
  }
 
+ /**
+ * Primary `window.location.href` navigation chokepoint for `@clerk/clerk-js` and `@clerk/ui`.
+ * By default the resolved URL is validated against the customer-supplied
+ * `allowedRedirectProtocols` option (the static `ALLOWED_PROTOCOLS` ∪ the customer extension),
+ * so internal callers honor customer protocols automatically.
+ *
+ * Pass `useStaticAllowlistOnly: true` to opt out of the customer extension when a call site
+ * must reject any protocol the customer added. There is no current internal consumer of the
+ * opt-out; it exists for future security-critical paths.
+ */
+ public __internal_windowNavigate = (to: URL | string, opts?: { useStaticAllowlistOnly?: boolean }): void => {
+ const allowedProtocols = opts?.useStaticAllowlistOnly ? ALLOWED_PROTOCOLS : this.#allowedRedirectProtocols;
+ windowNavigate(to, { allowedProtocols });
+ };
+
  #isLoaded(): this is LoadedClerk {
  return this.client !== undefined;
  }

packages/clerk-js/src/core/resources/SignIn.ts

@@ -7,7 +7,6 @@ import {
 } from '@clerk/shared/internal/clerk-js/passkeys';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
 import { getClerkQueryParam } from '@clerk/shared/internal/clerk-js/queryParams';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptFirstFactorParams,
@@ -392,7 +391,7 @@ export class SignIn extends BaseResource implements SignInResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignIn.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (params: AuthenticateWithPopupParams): Promise<void> => {
@@ -1199,7 +1198,7 @@ class SignInFuture implements SignInFutureResource {
  // Pick up the modified SignIn resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignIn.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/clerk-js/src/core/resources/SignUp.ts

@@ -1,7 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { type ClerkError, ClerkRuntimeError, isCaptchaError, isClerkAPIResponseError } from '@clerk/shared/error';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptEmailAddressVerificationParams,
@@ -462,7 +461,7 @@ export class SignUp extends BaseResource implements SignUpResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignUp.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (
@@ -1082,7 +1081,7 @@ class SignUpFuture implements SignUpFutureResource {
  // Pick up the modified SignUp resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignUp.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -434,4 +434,94 @@ describe('isomorphicClerk', () => {
  );
  });
  });
+
+ describe('__internal_windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ });
+
+ afterEach(() => {
+ Object.defineProperty(window, 'location', { configurable: true, value: originalLocation });
+ warnSpy.mockRestore();
+ });
+
+ it('delegates to clerk-js when the navigation chokepoint is available', () => {
+ const navigate = vi.fn();
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = { __internal_windowNavigate: navigate };
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in', { useStaticAllowlistOnly: true });
+
+ expect(navigate).toHaveBeenCalledWith('/sign-in', { useStaticAllowlistOnly: true });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ });
+
+ it('falls back to navigation when clerk-js is older and lacks the chokepoint', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ // An older clerk-js that does not expose __internal_windowNavigate.
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in');
+
+ expect(hrefSetter).toHaveBeenCalledWith('https://example.com/sign-in');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback honors the customer-supplied allowedRedirectProtocols option', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123');
+
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback fails closed for disallowed protocols', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('javascript:alert(1)');
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('fallback ignores customer protocols when useStaticAllowlistOnly is set', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123', { useStaticAllowlistOnly: true });
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+ });
 });

packages/react/src/isomorphicClerk.ts

@@ -1,5 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { clerkEvents, createClerkEventBus } from '@clerk/shared/clerkEventBus';
+import { ALLOWED_PROTOCOLS, windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { loadClerkJSScript, loadClerkUIScript } from '@clerk/shared/loadClerkJsScript';
 import type {
  __internal_AttemptToEnableEnvironmentSettingParams,
@@ -265,6 +266,25 @@ export class IsomorphicClerk implements IsomorphicLoadedClerk {
  return this.clerkjs?.__internal_getOption ? this.clerkjs?.__internal_getOption(key) : this.options[key];
  }
 
+ public __internal_windowNavigate: Clerk['__internal_windowNavigate'] = (to, opts) => {
+ const clerkjs = this.clerkjs;
+ if (typeof clerkjs?.__internal_windowNavigate === 'function') {
+ clerkjs.__internal_windowNavigate(to, opts);
+ return;
+ }
+
+ // Older clerk-js lacks this navigation chokepoint, so delegating would silently no-op. Fall back to
+ // the shared helper (browser-only, it touches window.location) so newer @clerk/ui still navigates and
+ // rejects disallowed protocols on an older clerk-js, honoring allowedRedirectProtocols unless opted out.
+ if (!inBrowser()) {
+ return;
+ }
+ const allowedProtocols = opts?.useStaticAllowlistOnly
+ ? ALLOWED_PROTOCOLS
+ : [...ALLOWED_PROTOCOLS, ...(this.options.allowedRedirectProtocols ?? [])];
+ windowNavigate(to, { allowedProtocols });
+ };
+
  constructor(options: IsomorphicClerkOptions) {
  this.#publishableKey = options?.publishableKey;
  this.#proxyUrl = options?.proxyUrl;

packages/shared/src/internal/clerk-js/__tests__/windowNavigate.test.ts

@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { ALLOWED_PROTOCOLS, CLERK_BEFORE_UNLOAD_EVENT, windowNavigate } from '../windowNavigate';
+
+describe('windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+ let eventSpy: ReturnType<typeof vi.fn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ (target as any).href = value;
+ return true;
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ eventSpy = vi.fn();
+ window.addEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ });
+
+ afterEach(() => {
+ window.removeEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: originalLocation,
+ });
+ warnSpy.mockRestore();
+ });
+
+ it.each([
+ ['absolute https URL', 'https://example.com/dashboard'],
+ ['absolute http URL', 'http://example.com/dashboard'],
+ ['relative path', '/sign-in'],
+ ['wails protocol', 'wails://app/route'],
+ ['chrome-extension protocol', 'chrome-extension://abc/route'],
+ ])('navigates to %s', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it.each([
+ ['javascript', 'javascript:alert(1)'],
+ ['data', 'data:text/html,<script>alert(1)</script>'],
+ ['file', 'file:///etc/passwd'],
+ ['vbscript', 'vbscript:msgbox(1)'],
+ ['mixed-case JavaScript', 'JavaScript:alert(1)'],
+ ['upper-case JAVASCRIPT', 'JAVASCRIPT:alert(1)'],
+ ['leading-whitespace javascript', ' javascript:alert(1)'],
+ ['leading-tab javascript', '\tjavascript:alert(1)'],
+ ['leading-newline javascript', '\njavascript:alert(1)'],
+ ])('blocks %s: protocol and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('blocks javascript: URLs that the URL parser normalizes via the base URL', () => {
+ windowNavigate('javascript:alert(location.origin)//');
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it.each([
+ ['scheme-relative //host', '//evil.example/path'],
+ ['scheme-relative ///host', '///evil.example/path'],
+ ['backslash \\\\host', '\\\\evil.example\\path'],
+ ['mixed /\\host', '/\\evil.example/path'],
+ ['mixed \\/host', '\\/evil.example/path'],
+ ['leading-whitespace scheme-relative', ' //evil.example/path'],
+ ['leading-tab scheme-relative', '\t//evil.example/path'],
+ // Control characters the URL parser strips but `trim()` does not: each still resolves
+ // scheme-relative against the base origin, so the guard must normalize before testing.
+ ['interior-tab scheme-relative', '/\t/evil.example/path'],
+ ['interior-newline scheme-relative', '/\n/evil.example/path'],
+ ['interior-cr scheme-relative', '/\r/evil.example/path'],
+ ['interior-tab backslash', '\\\t\\evil.example/path'],
+ ['leading-null scheme-relative', '\x00//evil.example/path'],
+ ['leading-c0-controls scheme-relative', '\x01\x02//evil.example/path'],
+ ])('blocks %s and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('still rejects scheme-relative URLs when an extended allowlist is supplied', () => {
+ windowNavigate('//evil.example/path', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('honors a caller-supplied extended allowlist for custom protocols', () => {
+ windowNavigate('slack://channel/123', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('still rejects disallowed protocols when an extended allowlist is supplied', () => {
+ windowNavigate('javascript:alert(1)', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+});

.changeset/windownavigate-protocol-allowlist.md

@@ -0,0 +1,10 @@
+---
+'@clerk/clerk-js': patch
+'@clerk/react': patch
+'@clerk/shared': patch
+'@clerk/ui': patch
+---
+
+Fix missing redirect URL protocol validation for Clerk UI browser navigations, including the multi-session add-account flow.
+
+Internal browser navigations now consistently honor configured redirect protocols and fail closed across mixed ClerkJS/UI bundle versions.

packages/clerk-js/bundlewatch.config.json

@@ -2,9 +2,9 @@
  "files": [
  { "path": "./dist/clerk.js", "maxSize": "549KB" },
  { "path": "./dist/clerk.browser.js", "maxSize": "74KB" },
- { "path": "./dist/clerk.legacy.browser.js", "maxSize": "115KB" },
+ { "path": "./dist/clerk.legacy.browser.js", "maxSize": "116KB" },
  { "path": "./dist/clerk.no-rhc.js", "maxSize": "316KB" },
- { "path": "./dist/clerk.native.js", "maxSize": "73KB" },
+ { "path": "./dist/clerk.native.js", "maxSize": "74KB" },
  { "path": "./dist/vendors*.js", "maxSize": "7KB" },
  { "path": "./dist/coinbase*.js", "maxSize": "36KB" },
  { "path": "./dist/base-account-sdk*.js", "maxSize": "207KB" },

packages/clerk-js/src/core/clerk.ts

@@ -1916,7 +1916,7 @@ export class Clerk implements ClerkInterface {
 
  if (customNavigate) {
  debugLogger.info(`Clerk is navigating to: ${to}`);
- return await customNavigate(to, { windowNavigate });
+ return await customNavigate(to, { windowNavigate: this.__internal_windowNavigate });
  }
 
  // No window.location and no custom router - can't navigate
@@ -1955,13 +1955,13 @@ export class Clerk implements ClerkInterface {
 
  // Custom protocol URLs have an origin value of 'null'. In many cases, this indicates deep-linking and we want to ensure the customNavigate function is used if available.
  if ((toURL.origin !== 'null' && toURL.origin !== window.location.origin) || !customNavigate) {
-windowNavigate(toURL);
+this.__internal_windowNavigate(toURL);
  return;
  }
 
  const metadata = {
  ...(options?.metadata ? { __internal_metadata: options?.metadata } : {}),
- windowNavigate,
+ windowNavigate: this.__internal_windowNavigate,
  };
  // React router only wants the path, search or hash portion.
  return await customNavigate(stripOrigin(toURL), metadata);
@@ -3578,6 +3578,21 @@ export class Clerk implements ClerkInterface {
  return allowedProtocols;
  }
 
+ /**
+ * Primary `window.location.href` navigation chokepoint for `@clerk/clerk-js` and `@clerk/ui`.
+ * By default the resolved URL is validated against the customer-supplied
+ * `allowedRedirectProtocols` option (the static `ALLOWED_PROTOCOLS` ∪ the customer extension),
+ * so internal callers honor customer protocols automatically.
+ *
+ * Pass `useStaticAllowlistOnly: true` to opt out of the customer extension when a call site
+ * must reject any protocol the customer added. There is no current internal consumer of the
+ * opt-out; it exists for future security-critical paths.
+ */
+ public __internal_windowNavigate = (to: URL | string, opts?: { useStaticAllowlistOnly?: boolean }): void => {
+ const allowedProtocols = opts?.useStaticAllowlistOnly ? ALLOWED_PROTOCOLS : this.#allowedRedirectProtocols;
+ windowNavigate(to, { allowedProtocols });
+ };
+
  #isLoaded(): this is LoadedClerk {
  return this.client !== undefined;
  }

packages/clerk-js/src/core/resources/SignIn.ts

@@ -7,7 +7,6 @@ import {
 } from '@clerk/shared/internal/clerk-js/passkeys';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
 import { getClerkQueryParam } from '@clerk/shared/internal/clerk-js/queryParams';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptFirstFactorParams,
@@ -392,7 +391,7 @@ export class SignIn extends BaseResource implements SignInResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignIn.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (params: AuthenticateWithPopupParams): Promise<void> => {
@@ -1199,7 +1198,7 @@ class SignInFuture implements SignInFutureResource {
  // Pick up the modified SignIn resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignIn.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/clerk-js/src/core/resources/SignUp.ts

@@ -1,7 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { type ClerkError, ClerkRuntimeError, isCaptchaError, isClerkAPIResponseError } from '@clerk/shared/error';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptEmailAddressVerificationParams,
@@ -462,7 +461,7 @@ export class SignUp extends BaseResource implements SignUpResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignUp.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (
@@ -1082,7 +1081,7 @@ class SignUpFuture implements SignUpFutureResource {
  // Pick up the modified SignUp resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignUp.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -434,4 +434,94 @@ describe('isomorphicClerk', () => {
  );
  });
  });
+
+ describe('__internal_windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ });
+
+ afterEach(() => {
+ Object.defineProperty(window, 'location', { configurable: true, value: originalLocation });
+ warnSpy.mockRestore();
+ });
+
+ it('delegates to clerk-js when the navigation chokepoint is available', () => {
+ const navigate = vi.fn();
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = { __internal_windowNavigate: navigate };
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in', { useStaticAllowlistOnly: true });
+
+ expect(navigate).toHaveBeenCalledWith('/sign-in', { useStaticAllowlistOnly: true });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ });
+
+ it('falls back to navigation when clerk-js is older and lacks the chokepoint', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ // An older clerk-js that does not expose __internal_windowNavigate.
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in');
+
+ expect(hrefSetter).toHaveBeenCalledWith('https://example.com/sign-in');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback honors the customer-supplied allowedRedirectProtocols option', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123');
+
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback fails closed for disallowed protocols', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('javascript:alert(1)');
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('fallback ignores customer protocols when useStaticAllowlistOnly is set', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123', { useStaticAllowlistOnly: true });
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+ });
 });

packages/react/src/isomorphicClerk.ts

@@ -1,5 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { clerkEvents, createClerkEventBus } from '@clerk/shared/clerkEventBus';
+import { ALLOWED_PROTOCOLS, windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { loadClerkJSScript, loadClerkUIScript } from '@clerk/shared/loadClerkJsScript';
 import type {
  __internal_AttemptToEnableEnvironmentSettingParams,
@@ -265,6 +266,25 @@ export class IsomorphicClerk implements IsomorphicLoadedClerk {
  return this.clerkjs?.__internal_getOption ? this.clerkjs?.__internal_getOption(key) : this.options[key];
  }
 
+ public __internal_windowNavigate: Clerk['__internal_windowNavigate'] = (to, opts) => {
+ const clerkjs = this.clerkjs;
+ if (typeof clerkjs?.__internal_windowNavigate === 'function') {
+ clerkjs.__internal_windowNavigate(to, opts);
+ return;
+ }
+
+ // Older clerk-js lacks this navigation chokepoint, so delegating would silently no-op. Fall back to
+ // the shared helper (browser-only, it touches window.location) so newer @clerk/ui still navigates and
+ // rejects disallowed protocols on an older clerk-js, honoring allowedRedirectProtocols unless opted out.
+ if (!inBrowser()) {
+ return;
+ }
+ const allowedProtocols = opts?.useStaticAllowlistOnly
+ ? ALLOWED_PROTOCOLS
+ : [...ALLOWED_PROTOCOLS, ...(this.options.allowedRedirectProtocols ?? [])];
+ windowNavigate(to, { allowedProtocols });
+ };
+
  constructor(options: IsomorphicClerkOptions) {
  this.#publishableKey = options?.publishableKey;
  this.#proxyUrl = options?.proxyUrl;

packages/shared/src/internal/clerk-js/__tests__/windowNavigate.test.ts

@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { ALLOWED_PROTOCOLS, CLERK_BEFORE_UNLOAD_EVENT, windowNavigate } from '../windowNavigate';
+
+describe('windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+ let eventSpy: ReturnType<typeof vi.fn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ (target as any).href = value;
+ return true;
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ eventSpy = vi.fn();
+ window.addEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ });
+
+ afterEach(() => {
+ window.removeEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: originalLocation,
+ });
+ warnSpy.mockRestore();
+ });
+
+ it.each([
+ ['absolute https URL', 'https://example.com/dashboard'],
+ ['absolute http URL', 'http://example.com/dashboard'],
+ ['relative path', '/sign-in'],
+ ['wails protocol', 'wails://app/route'],
+ ['chrome-extension protocol', 'chrome-extension://abc/route'],
+ ])('navigates to %s', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it.each([
+ ['javascript', 'javascript:alert(1)'],
+ ['data', 'data:text/html,<script>alert(1)</script>'],
+ ['file', 'file:///etc/passwd'],
+ ['vbscript', 'vbscript:msgbox(1)'],
+ ['mixed-case JavaScript', 'JavaScript:alert(1)'],
+ ['upper-case JAVASCRIPT', 'JAVASCRIPT:alert(1)'],
+ ['leading-whitespace javascript', ' javascript:alert(1)'],
+ ['leading-tab javascript', '\tjavascript:alert(1)'],
+ ['leading-newline javascript', '\njavascript:alert(1)'],
+ ])('blocks %s: protocol and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('blocks javascript: URLs that the URL parser normalizes via the base URL', () => {
+ windowNavigate('javascript:alert(location.origin)//');
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it.each([
+ ['scheme-relative //host', '//evil.example/path'],
+ ['scheme-relative ///host', '///evil.example/path'],
+ ['backslash \\\\host', '\\\\evil.example\\path'],
+ ['mixed /\\host', '/\\evil.example/path'],
+ ['mixed \\/host', '\\/evil.example/path'],
+ ['leading-whitespace scheme-relative', ' //evil.example/path'],
+ ['leading-tab scheme-relative', '\t//evil.example/path'],
+ // Control characters the URL parser strips but `trim()` does not: each still resolves
+ // scheme-relative against the base origin, so the guard must normalize before testing.
+ ['interior-tab scheme-relative', '/\t/evil.example/path'],
+ ['interior-newline scheme-relative', '/\n/evil.example/path'],
+ ['interior-cr scheme-relative', '/\r/evil.example/path'],
+ ['interior-tab backslash', '\\\t\\evil.example/path'],
+ ['leading-null scheme-relative', '\x00//evil.example/path'],
+ ['leading-c0-controls scheme-relative', '\x01\x02//evil.example/path'],
+ ])('blocks %s and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('still rejects scheme-relative URLs when an extended allowlist is supplied', () => {
+ windowNavigate('//evil.example/path', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('honors a caller-supplied extended allowlist for custom protocols', () => {
+ windowNavigate('slack://channel/123', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('still rejects disallowed protocols when an extended allowlist is supplied', () => {
+ windowNavigate('javascript:alert(1)', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+});

.changeset/windownavigate-protocol-allowlist.md

@@ -0,0 +1,10 @@
+---
+'@clerk/clerk-js': patch
+'@clerk/react': patch
+'@clerk/shared': patch
+'@clerk/ui': patch
+---
+
+Fix missing redirect URL protocol validation for Clerk UI browser navigations, including the multi-session add-account flow.
+
+Internal browser navigations now consistently honor configured redirect protocols and fail closed across mixed ClerkJS/UI bundle versions.

packages/clerk-js/bundlewatch.config.json

@@ -2,9 +2,9 @@
  "files": [
  { "path": "./dist/clerk.js", "maxSize": "549KB" },
  { "path": "./dist/clerk.browser.js", "maxSize": "74KB" },
- { "path": "./dist/clerk.legacy.browser.js", "maxSize": "115KB" },
+ { "path": "./dist/clerk.legacy.browser.js", "maxSize": "116KB" },
  { "path": "./dist/clerk.no-rhc.js", "maxSize": "316KB" },
- { "path": "./dist/clerk.native.js", "maxSize": "73KB" },
+ { "path": "./dist/clerk.native.js", "maxSize": "74KB" },
  { "path": "./dist/vendors*.js", "maxSize": "7KB" },
  { "path": "./dist/coinbase*.js", "maxSize": "36KB" },
  { "path": "./dist/base-account-sdk*.js", "maxSize": "207KB" },

packages/clerk-js/src/core/clerk.ts

@@ -1916,7 +1916,7 @@ export class Clerk implements ClerkInterface {
 
  if (customNavigate) {
  debugLogger.info(`Clerk is navigating to: ${to}`);
- return await customNavigate(to, { windowNavigate });
+ return await customNavigate(to, { windowNavigate: this.__internal_windowNavigate });
  }
 
  // No window.location and no custom router - can't navigate
@@ -1955,13 +1955,13 @@ export class Clerk implements ClerkInterface {
 
  // Custom protocol URLs have an origin value of 'null'. In many cases, this indicates deep-linking and we want to ensure the customNavigate function is used if available.
  if ((toURL.origin !== 'null' && toURL.origin !== window.location.origin) || !customNavigate) {
-windowNavigate(toURL);
+this.__internal_windowNavigate(toURL);
  return;
  }
 
  const metadata = {
  ...(options?.metadata ? { __internal_metadata: options?.metadata } : {}),
- windowNavigate,
+ windowNavigate: this.__internal_windowNavigate,
  };
  // React router only wants the path, search or hash portion.
  return await customNavigate(stripOrigin(toURL), metadata);
@@ -3578,6 +3578,21 @@ export class Clerk implements ClerkInterface {
  return allowedProtocols;
  }
 
+ /**
+ * Primary `window.location.href` navigation chokepoint for `@clerk/clerk-js` and `@clerk/ui`.
+ * By default the resolved URL is validated against the customer-supplied
+ * `allowedRedirectProtocols` option (the static `ALLOWED_PROTOCOLS` ∪ the customer extension),
+ * so internal callers honor customer protocols automatically.
+ *
+ * Pass `useStaticAllowlistOnly: true` to opt out of the customer extension when a call site
+ * must reject any protocol the customer added. There is no current internal consumer of the
+ * opt-out; it exists for future security-critical paths.
+ */
+ public __internal_windowNavigate = (to: URL | string, opts?: { useStaticAllowlistOnly?: boolean }): void => {
+ const allowedProtocols = opts?.useStaticAllowlistOnly ? ALLOWED_PROTOCOLS : this.#allowedRedirectProtocols;
+ windowNavigate(to, { allowedProtocols });
+ };
+
  #isLoaded(): this is LoadedClerk {
  return this.client !== undefined;
  }

packages/clerk-js/src/core/resources/SignIn.ts

@@ -7,7 +7,6 @@ import {
 } from '@clerk/shared/internal/clerk-js/passkeys';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
 import { getClerkQueryParam } from '@clerk/shared/internal/clerk-js/queryParams';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptFirstFactorParams,
@@ -392,7 +391,7 @@ export class SignIn extends BaseResource implements SignInResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignIn.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (params: AuthenticateWithPopupParams): Promise<void> => {
@@ -1199,7 +1198,7 @@ class SignInFuture implements SignInFutureResource {
  // Pick up the modified SignIn resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignIn.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/clerk-js/src/core/resources/SignUp.ts

@@ -1,7 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { type ClerkError, ClerkRuntimeError, isCaptchaError, isClerkAPIResponseError } from '@clerk/shared/error';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptEmailAddressVerificationParams,
@@ -462,7 +461,7 @@ export class SignUp extends BaseResource implements SignUpResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignUp.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (
@@ -1082,7 +1081,7 @@ class SignUpFuture implements SignUpFutureResource {
  // Pick up the modified SignUp resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignUp.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -434,4 +434,94 @@ describe('isomorphicClerk', () => {
  );
  });
  });
+
+ describe('__internal_windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ });
+
+ afterEach(() => {
+ Object.defineProperty(window, 'location', { configurable: true, value: originalLocation });
+ warnSpy.mockRestore();
+ });
+
+ it('delegates to clerk-js when the navigation chokepoint is available', () => {
+ const navigate = vi.fn();
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = { __internal_windowNavigate: navigate };
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in', { useStaticAllowlistOnly: true });
+
+ expect(navigate).toHaveBeenCalledWith('/sign-in', { useStaticAllowlistOnly: true });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ });
+
+ it('falls back to navigation when clerk-js is older and lacks the chokepoint', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ // An older clerk-js that does not expose __internal_windowNavigate.
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in');
+
+ expect(hrefSetter).toHaveBeenCalledWith('https://example.com/sign-in');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback honors the customer-supplied allowedRedirectProtocols option', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123');
+
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback fails closed for disallowed protocols', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('javascript:alert(1)');
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('fallback ignores customer protocols when useStaticAllowlistOnly is set', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123', { useStaticAllowlistOnly: true });
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+ });
 });

packages/react/src/isomorphicClerk.ts

@@ -1,5 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { clerkEvents, createClerkEventBus } from '@clerk/shared/clerkEventBus';
+import { ALLOWED_PROTOCOLS, windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { loadClerkJSScript, loadClerkUIScript } from '@clerk/shared/loadClerkJsScript';
 import type {
  __internal_AttemptToEnableEnvironmentSettingParams,
@@ -265,6 +266,25 @@ export class IsomorphicClerk implements IsomorphicLoadedClerk {
  return this.clerkjs?.__internal_getOption ? this.clerkjs?.__internal_getOption(key) : this.options[key];
  }
 
+ public __internal_windowNavigate: Clerk['__internal_windowNavigate'] = (to, opts) => {
+ const clerkjs = this.clerkjs;
+ if (typeof clerkjs?.__internal_windowNavigate === 'function') {
+ clerkjs.__internal_windowNavigate(to, opts);
+ return;
+ }
+
+ // Older clerk-js lacks this navigation chokepoint, so delegating would silently no-op. Fall back to
+ // the shared helper (browser-only, it touches window.location) so newer @clerk/ui still navigates and
+ // rejects disallowed protocols on an older clerk-js, honoring allowedRedirectProtocols unless opted out.
+ if (!inBrowser()) {
+ return;
+ }
+ const allowedProtocols = opts?.useStaticAllowlistOnly
+ ? ALLOWED_PROTOCOLS
+ : [...ALLOWED_PROTOCOLS, ...(this.options.allowedRedirectProtocols ?? [])];
+ windowNavigate(to, { allowedProtocols });
+ };
+
  constructor(options: IsomorphicClerkOptions) {
  this.#publishableKey = options?.publishableKey;
  this.#proxyUrl = options?.proxyUrl;

packages/shared/src/internal/clerk-js/__tests__/windowNavigate.test.ts

@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { ALLOWED_PROTOCOLS, CLERK_BEFORE_UNLOAD_EVENT, windowNavigate } from '../windowNavigate';
+
+describe('windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+ let eventSpy: ReturnType<typeof vi.fn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ (target as any).href = value;
+ return true;
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ eventSpy = vi.fn();
+ window.addEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ });
+
+ afterEach(() => {
+ window.removeEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: originalLocation,
+ });
+ warnSpy.mockRestore();
+ });
+
+ it.each([
+ ['absolute https URL', 'https://example.com/dashboard'],
+ ['absolute http URL', 'http://example.com/dashboard'],
+ ['relative path', '/sign-in'],
+ ['wails protocol', 'wails://app/route'],
+ ['chrome-extension protocol', 'chrome-extension://abc/route'],
+ ])('navigates to %s', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it.each([
+ ['javascript', 'javascript:alert(1)'],
+ ['data', 'data:text/html,<script>alert(1)</script>'],
+ ['file', 'file:///etc/passwd'],
+ ['vbscript', 'vbscript:msgbox(1)'],
+ ['mixed-case JavaScript', 'JavaScript:alert(1)'],
+ ['upper-case JAVASCRIPT', 'JAVASCRIPT:alert(1)'],
+ ['leading-whitespace javascript', ' javascript:alert(1)'],
+ ['leading-tab javascript', '\tjavascript:alert(1)'],
+ ['leading-newline javascript', '\njavascript:alert(1)'],
+ ])('blocks %s: protocol and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('blocks javascript: URLs that the URL parser normalizes via the base URL', () => {
+ windowNavigate('javascript:alert(location.origin)//');
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it.each([
+ ['scheme-relative //host', '//evil.example/path'],
+ ['scheme-relative ///host', '///evil.example/path'],
+ ['backslash \\\\host', '\\\\evil.example\\path'],
+ ['mixed /\\host', '/\\evil.example/path'],
+ ['mixed \\/host', '\\/evil.example/path'],
+ ['leading-whitespace scheme-relative', ' //evil.example/path'],
+ ['leading-tab scheme-relative', '\t//evil.example/path'],
+ // Control characters the URL parser strips but `trim()` does not: each still resolves
+ // scheme-relative against the base origin, so the guard must normalize before testing.
+ ['interior-tab scheme-relative', '/\t/evil.example/path'],
+ ['interior-newline scheme-relative', '/\n/evil.example/path'],
+ ['interior-cr scheme-relative', '/\r/evil.example/path'],
+ ['interior-tab backslash', '\\\t\\evil.example/path'],
+ ['leading-null scheme-relative', '\x00//evil.example/path'],
+ ['leading-c0-controls scheme-relative', '\x01\x02//evil.example/path'],
+ ])('blocks %s and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('still rejects scheme-relative URLs when an extended allowlist is supplied', () => {
+ windowNavigate('//evil.example/path', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('honors a caller-supplied extended allowlist for custom protocols', () => {
+ windowNavigate('slack://channel/123', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('still rejects disallowed protocols when an extended allowlist is supplied', () => {
+ windowNavigate('javascript:alert(1)', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+});

.changeset/windownavigate-protocol-allowlist.md

@@ -0,0 +1,10 @@
+---
+'@clerk/clerk-js': patch
+'@clerk/react': patch
+'@clerk/shared': patch
+'@clerk/ui': patch
+---
+
+Fix missing redirect URL protocol validation for Clerk UI browser navigations, including the multi-session add-account flow.
+
+Internal browser navigations now consistently honor configured redirect protocols and fail closed across mixed ClerkJS/UI bundle versions.

packages/clerk-js/bundlewatch.config.json

@@ -2,9 +2,9 @@
  "files": [
  { "path": "./dist/clerk.js", "maxSize": "549KB" },
  { "path": "./dist/clerk.browser.js", "maxSize": "74KB" },
- { "path": "./dist/clerk.legacy.browser.js", "maxSize": "115KB" },
+ { "path": "./dist/clerk.legacy.browser.js", "maxSize": "116KB" },
  { "path": "./dist/clerk.no-rhc.js", "maxSize": "316KB" },
- { "path": "./dist/clerk.native.js", "maxSize": "73KB" },
+ { "path": "./dist/clerk.native.js", "maxSize": "74KB" },
  { "path": "./dist/vendors*.js", "maxSize": "7KB" },
  { "path": "./dist/coinbase*.js", "maxSize": "36KB" },
  { "path": "./dist/base-account-sdk*.js", "maxSize": "207KB" },

packages/clerk-js/src/core/clerk.ts

@@ -1916,7 +1916,7 @@ export class Clerk implements ClerkInterface {
 
  if (customNavigate) {
  debugLogger.info(`Clerk is navigating to: ${to}`);
- return await customNavigate(to, { windowNavigate });
+ return await customNavigate(to, { windowNavigate: this.__internal_windowNavigate });
  }
 
  // No window.location and no custom router - can't navigate
@@ -1955,13 +1955,13 @@ export class Clerk implements ClerkInterface {
 
  // Custom protocol URLs have an origin value of 'null'. In many cases, this indicates deep-linking and we want to ensure the customNavigate function is used if available.
  if ((toURL.origin !== 'null' && toURL.origin !== window.location.origin) || !customNavigate) {
-windowNavigate(toURL);
+this.__internal_windowNavigate(toURL);
  return;
  }
 
  const metadata = {
  ...(options?.metadata ? { __internal_metadata: options?.metadata } : {}),
- windowNavigate,
+ windowNavigate: this.__internal_windowNavigate,
  };
  // React router only wants the path, search or hash portion.
  return await customNavigate(stripOrigin(toURL), metadata);
@@ -3578,6 +3578,21 @@ export class Clerk implements ClerkInterface {
  return allowedProtocols;
  }
 
+ /**
+ * Primary `window.location.href` navigation chokepoint for `@clerk/clerk-js` and `@clerk/ui`.
+ * By default the resolved URL is validated against the customer-supplied
+ * `allowedRedirectProtocols` option (the static `ALLOWED_PROTOCOLS` ∪ the customer extension),
+ * so internal callers honor customer protocols automatically.
+ *
+ * Pass `useStaticAllowlistOnly: true` to opt out of the customer extension when a call site
+ * must reject any protocol the customer added. There is no current internal consumer of the
+ * opt-out; it exists for future security-critical paths.
+ */
+ public __internal_windowNavigate = (to: URL | string, opts?: { useStaticAllowlistOnly?: boolean }): void => {
+ const allowedProtocols = opts?.useStaticAllowlistOnly ? ALLOWED_PROTOCOLS : this.#allowedRedirectProtocols;
+ windowNavigate(to, { allowedProtocols });
+ };
+
  #isLoaded(): this is LoadedClerk {
  return this.client !== undefined;
  }

packages/clerk-js/src/core/resources/SignIn.ts

@@ -7,7 +7,6 @@ import {
 } from '@clerk/shared/internal/clerk-js/passkeys';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
 import { getClerkQueryParam } from '@clerk/shared/internal/clerk-js/queryParams';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptFirstFactorParams,
@@ -392,7 +391,7 @@ export class SignIn extends BaseResource implements SignInResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignIn.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (params: AuthenticateWithPopupParams): Promise<void> => {
@@ -1199,7 +1198,7 @@ class SignInFuture implements SignInFutureResource {
  // Pick up the modified SignIn resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignIn.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/clerk-js/src/core/resources/SignUp.ts

@@ -1,7 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { type ClerkError, ClerkRuntimeError, isCaptchaError, isClerkAPIResponseError } from '@clerk/shared/error';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptEmailAddressVerificationParams,
@@ -462,7 +461,7 @@ export class SignUp extends BaseResource implements SignUpResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignUp.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (
@@ -1082,7 +1081,7 @@ class SignUpFuture implements SignUpFutureResource {
  // Pick up the modified SignUp resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignUp.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -434,4 +434,94 @@ describe('isomorphicClerk', () => {
  );
  });
  });
+
+ describe('__internal_windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ });
+
+ afterEach(() => {
+ Object.defineProperty(window, 'location', { configurable: true, value: originalLocation });
+ warnSpy.mockRestore();
+ });
+
+ it('delegates to clerk-js when the navigation chokepoint is available', () => {
+ const navigate = vi.fn();
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = { __internal_windowNavigate: navigate };
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in', { useStaticAllowlistOnly: true });
+
+ expect(navigate).toHaveBeenCalledWith('/sign-in', { useStaticAllowlistOnly: true });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ });
+
+ it('falls back to navigation when clerk-js is older and lacks the chokepoint', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ // An older clerk-js that does not expose __internal_windowNavigate.
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in');
+
+ expect(hrefSetter).toHaveBeenCalledWith('https://example.com/sign-in');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback honors the customer-supplied allowedRedirectProtocols option', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123');
+
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback fails closed for disallowed protocols', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('javascript:alert(1)');
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('fallback ignores customer protocols when useStaticAllowlistOnly is set', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123', { useStaticAllowlistOnly: true });
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+ });
 });

packages/react/src/isomorphicClerk.ts

@@ -1,5 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { clerkEvents, createClerkEventBus } from '@clerk/shared/clerkEventBus';
+import { ALLOWED_PROTOCOLS, windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { loadClerkJSScript, loadClerkUIScript } from '@clerk/shared/loadClerkJsScript';
 import type {
  __internal_AttemptToEnableEnvironmentSettingParams,
@@ -265,6 +266,25 @@ export class IsomorphicClerk implements IsomorphicLoadedClerk {
  return this.clerkjs?.__internal_getOption ? this.clerkjs?.__internal_getOption(key) : this.options[key];
  }
 
+ public __internal_windowNavigate: Clerk['__internal_windowNavigate'] = (to, opts) => {
+ const clerkjs = this.clerkjs;
+ if (typeof clerkjs?.__internal_windowNavigate === 'function') {
+ clerkjs.__internal_windowNavigate(to, opts);
+ return;
+ }
+
+ // Older clerk-js lacks this navigation chokepoint, so delegating would silently no-op. Fall back to
+ // the shared helper (browser-only, it touches window.location) so newer @clerk/ui still navigates and
+ // rejects disallowed protocols on an older clerk-js, honoring allowedRedirectProtocols unless opted out.
+ if (!inBrowser()) {
+ return;
+ }
+ const allowedProtocols = opts?.useStaticAllowlistOnly
+ ? ALLOWED_PROTOCOLS
+ : [...ALLOWED_PROTOCOLS, ...(this.options.allowedRedirectProtocols ?? [])];
+ windowNavigate(to, { allowedProtocols });
+ };
+
  constructor(options: IsomorphicClerkOptions) {
  this.#publishableKey = options?.publishableKey;
  this.#proxyUrl = options?.proxyUrl;

packages/shared/src/internal/clerk-js/__tests__/windowNavigate.test.ts

@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { ALLOWED_PROTOCOLS, CLERK_BEFORE_UNLOAD_EVENT, windowNavigate } from '../windowNavigate';
+
+describe('windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+ let eventSpy: ReturnType<typeof vi.fn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ (target as any).href = value;
+ return true;
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ eventSpy = vi.fn();
+ window.addEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ });
+
+ afterEach(() => {
+ window.removeEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: originalLocation,
+ });
+ warnSpy.mockRestore();
+ });
+
+ it.each([
+ ['absolute https URL', 'https://example.com/dashboard'],
+ ['absolute http URL', 'http://example.com/dashboard'],
+ ['relative path', '/sign-in'],
+ ['wails protocol', 'wails://app/route'],
+ ['chrome-extension protocol', 'chrome-extension://abc/route'],
+ ])('navigates to %s', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it.each([
+ ['javascript', 'javascript:alert(1)'],
+ ['data', 'data:text/html,<script>alert(1)</script>'],
+ ['file', 'file:///etc/passwd'],
+ ['vbscript', 'vbscript:msgbox(1)'],
+ ['mixed-case JavaScript', 'JavaScript:alert(1)'],
+ ['upper-case JAVASCRIPT', 'JAVASCRIPT:alert(1)'],
+ ['leading-whitespace javascript', ' javascript:alert(1)'],
+ ['leading-tab javascript', '\tjavascript:alert(1)'],
+ ['leading-newline javascript', '\njavascript:alert(1)'],
+ ])('blocks %s: protocol and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('blocks javascript: URLs that the URL parser normalizes via the base URL', () => {
+ windowNavigate('javascript:alert(location.origin)//');
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it.each([
+ ['scheme-relative //host', '//evil.example/path'],
+ ['scheme-relative ///host', '///evil.example/path'],
+ ['backslash \\\\host', '\\\\evil.example\\path'],
+ ['mixed /\\host', '/\\evil.example/path'],
+ ['mixed \\/host', '\\/evil.example/path'],
+ ['leading-whitespace scheme-relative', ' //evil.example/path'],
+ ['leading-tab scheme-relative', '\t//evil.example/path'],
+ // Control characters the URL parser strips but `trim()` does not: each still resolves
+ // scheme-relative against the base origin, so the guard must normalize before testing.
+ ['interior-tab scheme-relative', '/\t/evil.example/path'],
+ ['interior-newline scheme-relative', '/\n/evil.example/path'],
+ ['interior-cr scheme-relative', '/\r/evil.example/path'],
+ ['interior-tab backslash', '\\\t\\evil.example/path'],
+ ['leading-null scheme-relative', '\x00//evil.example/path'],
+ ['leading-c0-controls scheme-relative', '\x01\x02//evil.example/path'],
+ ])('blocks %s and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('still rejects scheme-relative URLs when an extended allowlist is supplied', () => {
+ windowNavigate('//evil.example/path', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('honors a caller-supplied extended allowlist for custom protocols', () => {
+ windowNavigate('slack://channel/123', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('still rejects disallowed protocols when an extended allowlist is supplied', () => {
+ windowNavigate('javascript:alert(1)', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+});

.changeset/windownavigate-protocol-allowlist.md

@@ -0,0 +1,10 @@
+---
+'@clerk/clerk-js': patch
+'@clerk/react': patch
+'@clerk/shared': patch
+'@clerk/ui': patch
+---
+
+Fix missing redirect URL protocol validation for Clerk UI browser navigations, including the multi-session add-account flow.
+
+Internal browser navigations now consistently honor configured redirect protocols and fail closed across mixed ClerkJS/UI bundle versions.

packages/clerk-js/bundlewatch.config.json

@@ -2,9 +2,9 @@
  "files": [
  { "path": "./dist/clerk.js", "maxSize": "549KB" },
  { "path": "./dist/clerk.browser.js", "maxSize": "74KB" },
- { "path": "./dist/clerk.legacy.browser.js", "maxSize": "115KB" },
+ { "path": "./dist/clerk.legacy.browser.js", "maxSize": "116KB" },
  { "path": "./dist/clerk.no-rhc.js", "maxSize": "316KB" },
- { "path": "./dist/clerk.native.js", "maxSize": "73KB" },
+ { "path": "./dist/clerk.native.js", "maxSize": "74KB" },
  { "path": "./dist/vendors*.js", "maxSize": "7KB" },
  { "path": "./dist/coinbase*.js", "maxSize": "36KB" },
  { "path": "./dist/base-account-sdk*.js", "maxSize": "207KB" },

packages/clerk-js/src/core/clerk.ts

@@ -1916,7 +1916,7 @@ export class Clerk implements ClerkInterface {
 
  if (customNavigate) {
  debugLogger.info(`Clerk is navigating to: ${to}`);
- return await customNavigate(to, { windowNavigate });
+ return await customNavigate(to, { windowNavigate: this.__internal_windowNavigate });
  }
 
  // No window.location and no custom router - can't navigate
@@ -1955,13 +1955,13 @@ export class Clerk implements ClerkInterface {
 
  // Custom protocol URLs have an origin value of 'null'. In many cases, this indicates deep-linking and we want to ensure the customNavigate function is used if available.
  if ((toURL.origin !== 'null' && toURL.origin !== window.location.origin) || !customNavigate) {
-windowNavigate(toURL);
+this.__internal_windowNavigate(toURL);
  return;
  }
 
  const metadata = {
  ...(options?.metadata ? { __internal_metadata: options?.metadata } : {}),
- windowNavigate,
+ windowNavigate: this.__internal_windowNavigate,
  };
  // React router only wants the path, search or hash portion.
  return await customNavigate(stripOrigin(toURL), metadata);
@@ -3578,6 +3578,21 @@ export class Clerk implements ClerkInterface {
  return allowedProtocols;
  }
 
+ /**
+ * Primary `window.location.href` navigation chokepoint for `@clerk/clerk-js` and `@clerk/ui`.
+ * By default the resolved URL is validated against the customer-supplied
+ * `allowedRedirectProtocols` option (the static `ALLOWED_PROTOCOLS` ∪ the customer extension),
+ * so internal callers honor customer protocols automatically.
+ *
+ * Pass `useStaticAllowlistOnly: true` to opt out of the customer extension when a call site
+ * must reject any protocol the customer added. There is no current internal consumer of the
+ * opt-out; it exists for future security-critical paths.
+ */
+ public __internal_windowNavigate = (to: URL | string, opts?: { useStaticAllowlistOnly?: boolean }): void => {
+ const allowedProtocols = opts?.useStaticAllowlistOnly ? ALLOWED_PROTOCOLS : this.#allowedRedirectProtocols;
+ windowNavigate(to, { allowedProtocols });
+ };
+
  #isLoaded(): this is LoadedClerk {
  return this.client !== undefined;
  }

packages/clerk-js/src/core/resources/SignIn.ts

@@ -7,7 +7,6 @@ import {
 } from '@clerk/shared/internal/clerk-js/passkeys';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
 import { getClerkQueryParam } from '@clerk/shared/internal/clerk-js/queryParams';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptFirstFactorParams,
@@ -392,7 +391,7 @@ export class SignIn extends BaseResource implements SignInResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignIn.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (params: AuthenticateWithPopupParams): Promise<void> => {
@@ -1199,7 +1198,7 @@ class SignInFuture implements SignInFutureResource {
  // Pick up the modified SignIn resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignIn.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/clerk-js/src/core/resources/SignUp.ts

@@ -1,7 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { type ClerkError, ClerkRuntimeError, isCaptchaError, isClerkAPIResponseError } from '@clerk/shared/error';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptEmailAddressVerificationParams,
@@ -462,7 +461,7 @@ export class SignUp extends BaseResource implements SignUpResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignUp.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (
@@ -1082,7 +1081,7 @@ class SignUpFuture implements SignUpFutureResource {
  // Pick up the modified SignUp resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignUp.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -434,4 +434,94 @@ describe('isomorphicClerk', () => {
  );
  });
  });
+
+ describe('__internal_windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ });
+
+ afterEach(() => {
+ Object.defineProperty(window, 'location', { configurable: true, value: originalLocation });
+ warnSpy.mockRestore();
+ });
+
+ it('delegates to clerk-js when the navigation chokepoint is available', () => {
+ const navigate = vi.fn();
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = { __internal_windowNavigate: navigate };
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in', { useStaticAllowlistOnly: true });
+
+ expect(navigate).toHaveBeenCalledWith('/sign-in', { useStaticAllowlistOnly: true });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ });
+
+ it('falls back to navigation when clerk-js is older and lacks the chokepoint', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ // An older clerk-js that does not expose __internal_windowNavigate.
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in');
+
+ expect(hrefSetter).toHaveBeenCalledWith('https://example.com/sign-in');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback honors the customer-supplied allowedRedirectProtocols option', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123');
+
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback fails closed for disallowed protocols', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('javascript:alert(1)');
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('fallback ignores customer protocols when useStaticAllowlistOnly is set', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123', { useStaticAllowlistOnly: true });
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+ });
 });

packages/react/src/isomorphicClerk.ts

@@ -1,5 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { clerkEvents, createClerkEventBus } from '@clerk/shared/clerkEventBus';
+import { ALLOWED_PROTOCOLS, windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { loadClerkJSScript, loadClerkUIScript } from '@clerk/shared/loadClerkJsScript';
 import type {
  __internal_AttemptToEnableEnvironmentSettingParams,
@@ -265,6 +266,25 @@ export class IsomorphicClerk implements IsomorphicLoadedClerk {
  return this.clerkjs?.__internal_getOption ? this.clerkjs?.__internal_getOption(key) : this.options[key];
  }
 
+ public __internal_windowNavigate: Clerk['__internal_windowNavigate'] = (to, opts) => {
+ const clerkjs = this.clerkjs;
+ if (typeof clerkjs?.__internal_windowNavigate === 'function') {
+ clerkjs.__internal_windowNavigate(to, opts);
+ return;
+ }
+
+ // Older clerk-js lacks this navigation chokepoint, so delegating would silently no-op. Fall back to
+ // the shared helper (browser-only, it touches window.location) so newer @clerk/ui still navigates and
+ // rejects disallowed protocols on an older clerk-js, honoring allowedRedirectProtocols unless opted out.
+ if (!inBrowser()) {
+ return;
+ }
+ const allowedProtocols = opts?.useStaticAllowlistOnly
+ ? ALLOWED_PROTOCOLS
+ : [...ALLOWED_PROTOCOLS, ...(this.options.allowedRedirectProtocols ?? [])];
+ windowNavigate(to, { allowedProtocols });
+ };
+
  constructor(options: IsomorphicClerkOptions) {
  this.#publishableKey = options?.publishableKey;
  this.#proxyUrl = options?.proxyUrl;

packages/shared/src/internal/clerk-js/__tests__/windowNavigate.test.ts

@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { ALLOWED_PROTOCOLS, CLERK_BEFORE_UNLOAD_EVENT, windowNavigate } from '../windowNavigate';
+
+describe('windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+ let eventSpy: ReturnType<typeof vi.fn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ (target as any).href = value;
+ return true;
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ eventSpy = vi.fn();
+ window.addEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ });
+
+ afterEach(() => {
+ window.removeEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: originalLocation,
+ });
+ warnSpy.mockRestore();
+ });
+
+ it.each([
+ ['absolute https URL', 'https://example.com/dashboard'],
+ ['absolute http URL', 'http://example.com/dashboard'],
+ ['relative path', '/sign-in'],
+ ['wails protocol', 'wails://app/route'],
+ ['chrome-extension protocol', 'chrome-extension://abc/route'],
+ ])('navigates to %s', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it.each([
+ ['javascript', 'javascript:alert(1)'],
+ ['data', 'data:text/html,<script>alert(1)</script>'],
+ ['file', 'file:///etc/passwd'],
+ ['vbscript', 'vbscript:msgbox(1)'],
+ ['mixed-case JavaScript', 'JavaScript:alert(1)'],
+ ['upper-case JAVASCRIPT', 'JAVASCRIPT:alert(1)'],
+ ['leading-whitespace javascript', ' javascript:alert(1)'],
+ ['leading-tab javascript', '\tjavascript:alert(1)'],
+ ['leading-newline javascript', '\njavascript:alert(1)'],
+ ])('blocks %s: protocol and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('blocks javascript: URLs that the URL parser normalizes via the base URL', () => {
+ windowNavigate('javascript:alert(location.origin)//');
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it.each([
+ ['scheme-relative //host', '//evil.example/path'],
+ ['scheme-relative ///host', '///evil.example/path'],
+ ['backslash \\\\host', '\\\\evil.example\\path'],
+ ['mixed /\\host', '/\\evil.example/path'],
+ ['mixed \\/host', '\\/evil.example/path'],
+ ['leading-whitespace scheme-relative', ' //evil.example/path'],
+ ['leading-tab scheme-relative', '\t//evil.example/path'],
+ // Control characters the URL parser strips but `trim()` does not: each still resolves
+ // scheme-relative against the base origin, so the guard must normalize before testing.
+ ['interior-tab scheme-relative', '/\t/evil.example/path'],
+ ['interior-newline scheme-relative', '/\n/evil.example/path'],
+ ['interior-cr scheme-relative', '/\r/evil.example/path'],
+ ['interior-tab backslash', '\\\t\\evil.example/path'],
+ ['leading-null scheme-relative', '\x00//evil.example/path'],
+ ['leading-c0-controls scheme-relative', '\x01\x02//evil.example/path'],
+ ])('blocks %s and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('still rejects scheme-relative URLs when an extended allowlist is supplied', () => {
+ windowNavigate('//evil.example/path', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('honors a caller-supplied extended allowlist for custom protocols', () => {
+ windowNavigate('slack://channel/123', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('still rejects disallowed protocols when an extended allowlist is supplied', () => {
+ windowNavigate('javascript:alert(1)', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+});

.changeset/windownavigate-protocol-allowlist.md

@@ -0,0 +1,10 @@
+---
+'@clerk/clerk-js': patch
+'@clerk/react': patch
+'@clerk/shared': patch
+'@clerk/ui': patch
+---
+
+Fix missing redirect URL protocol validation for Clerk UI browser navigations, including the multi-session add-account flow.
+
+Internal browser navigations now consistently honor configured redirect protocols and fail closed across mixed ClerkJS/UI bundle versions.

packages/clerk-js/bundlewatch.config.json

@@ -2,9 +2,9 @@
  "files": [
  { "path": "./dist/clerk.js", "maxSize": "549KB" },
  { "path": "./dist/clerk.browser.js", "maxSize": "74KB" },
- { "path": "./dist/clerk.legacy.browser.js", "maxSize": "115KB" },
+ { "path": "./dist/clerk.legacy.browser.js", "maxSize": "116KB" },
  { "path": "./dist/clerk.no-rhc.js", "maxSize": "316KB" },
- { "path": "./dist/clerk.native.js", "maxSize": "73KB" },
+ { "path": "./dist/clerk.native.js", "maxSize": "74KB" },
  { "path": "./dist/vendors*.js", "maxSize": "7KB" },
  { "path": "./dist/coinbase*.js", "maxSize": "36KB" },
  { "path": "./dist/base-account-sdk*.js", "maxSize": "207KB" },

packages/clerk-js/src/core/clerk.ts

@@ -1916,7 +1916,7 @@ export class Clerk implements ClerkInterface {
 
  if (customNavigate) {
  debugLogger.info(`Clerk is navigating to: ${to}`);
- return await customNavigate(to, { windowNavigate });
+ return await customNavigate(to, { windowNavigate: this.__internal_windowNavigate });
  }
 
  // No window.location and no custom router - can't navigate
@@ -1955,13 +1955,13 @@ export class Clerk implements ClerkInterface {
 
  // Custom protocol URLs have an origin value of 'null'. In many cases, this indicates deep-linking and we want to ensure the customNavigate function is used if available.
  if ((toURL.origin !== 'null' && toURL.origin !== window.location.origin) || !customNavigate) {
-windowNavigate(toURL);
+this.__internal_windowNavigate(toURL);
  return;
  }
 
  const metadata = {
  ...(options?.metadata ? { __internal_metadata: options?.metadata } : {}),
- windowNavigate,
+ windowNavigate: this.__internal_windowNavigate,
  };
  // React router only wants the path, search or hash portion.
  return await customNavigate(stripOrigin(toURL), metadata);
@@ -3578,6 +3578,21 @@ export class Clerk implements ClerkInterface {
  return allowedProtocols;
  }
 
+ /**
+ * Primary `window.location.href` navigation chokepoint for `@clerk/clerk-js` and `@clerk/ui`.
+ * By default the resolved URL is validated against the customer-supplied
+ * `allowedRedirectProtocols` option (the static `ALLOWED_PROTOCOLS` ∪ the customer extension),
+ * so internal callers honor customer protocols automatically.
+ *
+ * Pass `useStaticAllowlistOnly: true` to opt out of the customer extension when a call site
+ * must reject any protocol the customer added. There is no current internal consumer of the
+ * opt-out; it exists for future security-critical paths.
+ */
+ public __internal_windowNavigate = (to: URL | string, opts?: { useStaticAllowlistOnly?: boolean }): void => {
+ const allowedProtocols = opts?.useStaticAllowlistOnly ? ALLOWED_PROTOCOLS : this.#allowedRedirectProtocols;
+ windowNavigate(to, { allowedProtocols });
+ };
+
  #isLoaded(): this is LoadedClerk {
  return this.client !== undefined;
  }

packages/clerk-js/src/core/resources/SignIn.ts

@@ -7,7 +7,6 @@ import {
 } from '@clerk/shared/internal/clerk-js/passkeys';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
 import { getClerkQueryParam } from '@clerk/shared/internal/clerk-js/queryParams';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptFirstFactorParams,
@@ -392,7 +391,7 @@ export class SignIn extends BaseResource implements SignInResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignIn.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (params: AuthenticateWithPopupParams): Promise<void> => {
@@ -1199,7 +1198,7 @@ class SignInFuture implements SignInFutureResource {
  // Pick up the modified SignIn resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignIn.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/clerk-js/src/core/resources/SignUp.ts

@@ -1,7 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { type ClerkError, ClerkRuntimeError, isCaptchaError, isClerkAPIResponseError } from '@clerk/shared/error';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptEmailAddressVerificationParams,
@@ -462,7 +461,7 @@ export class SignUp extends BaseResource implements SignUpResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignUp.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (
@@ -1082,7 +1081,7 @@ class SignUpFuture implements SignUpFutureResource {
  // Pick up the modified SignUp resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignUp.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -434,4 +434,94 @@ describe('isomorphicClerk', () => {
  );
  });
  });
+
+ describe('__internal_windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ });
+
+ afterEach(() => {
+ Object.defineProperty(window, 'location', { configurable: true, value: originalLocation });
+ warnSpy.mockRestore();
+ });
+
+ it('delegates to clerk-js when the navigation chokepoint is available', () => {
+ const navigate = vi.fn();
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = { __internal_windowNavigate: navigate };
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in', { useStaticAllowlistOnly: true });
+
+ expect(navigate).toHaveBeenCalledWith('/sign-in', { useStaticAllowlistOnly: true });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ });
+
+ it('falls back to navigation when clerk-js is older and lacks the chokepoint', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ // An older clerk-js that does not expose __internal_windowNavigate.
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in');
+
+ expect(hrefSetter).toHaveBeenCalledWith('https://example.com/sign-in');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback honors the customer-supplied allowedRedirectProtocols option', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123');
+
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback fails closed for disallowed protocols', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('javascript:alert(1)');
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('fallback ignores customer protocols when useStaticAllowlistOnly is set', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123', { useStaticAllowlistOnly: true });
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+ });
 });

packages/react/src/isomorphicClerk.ts

@@ -1,5 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { clerkEvents, createClerkEventBus } from '@clerk/shared/clerkEventBus';
+import { ALLOWED_PROTOCOLS, windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { loadClerkJSScript, loadClerkUIScript } from '@clerk/shared/loadClerkJsScript';
 import type {
  __internal_AttemptToEnableEnvironmentSettingParams,
@@ -265,6 +266,25 @@ export class IsomorphicClerk implements IsomorphicLoadedClerk {
  return this.clerkjs?.__internal_getOption ? this.clerkjs?.__internal_getOption(key) : this.options[key];
  }
 
+ public __internal_windowNavigate: Clerk['__internal_windowNavigate'] = (to, opts) => {
+ const clerkjs = this.clerkjs;
+ if (typeof clerkjs?.__internal_windowNavigate === 'function') {
+ clerkjs.__internal_windowNavigate(to, opts);
+ return;
+ }
+
+ // Older clerk-js lacks this navigation chokepoint, so delegating would silently no-op. Fall back to
+ // the shared helper (browser-only, it touches window.location) so newer @clerk/ui still navigates and
+ // rejects disallowed protocols on an older clerk-js, honoring allowedRedirectProtocols unless opted out.
+ if (!inBrowser()) {
+ return;
+ }
+ const allowedProtocols = opts?.useStaticAllowlistOnly
+ ? ALLOWED_PROTOCOLS
+ : [...ALLOWED_PROTOCOLS, ...(this.options.allowedRedirectProtocols ?? [])];
+ windowNavigate(to, { allowedProtocols });
+ };
+
  constructor(options: IsomorphicClerkOptions) {
  this.#publishableKey = options?.publishableKey;
  this.#proxyUrl = options?.proxyUrl;

packages/shared/src/internal/clerk-js/__tests__/windowNavigate.test.ts

@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { ALLOWED_PROTOCOLS, CLERK_BEFORE_UNLOAD_EVENT, windowNavigate } from '../windowNavigate';
+
+describe('windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+ let eventSpy: ReturnType<typeof vi.fn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ (target as any).href = value;
+ return true;
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ eventSpy = vi.fn();
+ window.addEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ });
+
+ afterEach(() => {
+ window.removeEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: originalLocation,
+ });
+ warnSpy.mockRestore();
+ });
+
+ it.each([
+ ['absolute https URL', 'https://example.com/dashboard'],
+ ['absolute http URL', 'http://example.com/dashboard'],
+ ['relative path', '/sign-in'],
+ ['wails protocol', 'wails://app/route'],
+ ['chrome-extension protocol', 'chrome-extension://abc/route'],
+ ])('navigates to %s', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it.each([
+ ['javascript', 'javascript:alert(1)'],
+ ['data', 'data:text/html,<script>alert(1)</script>'],
+ ['file', 'file:///etc/passwd'],
+ ['vbscript', 'vbscript:msgbox(1)'],
+ ['mixed-case JavaScript', 'JavaScript:alert(1)'],
+ ['upper-case JAVASCRIPT', 'JAVASCRIPT:alert(1)'],
+ ['leading-whitespace javascript', ' javascript:alert(1)'],
+ ['leading-tab javascript', '\tjavascript:alert(1)'],
+ ['leading-newline javascript', '\njavascript:alert(1)'],
+ ])('blocks %s: protocol and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('blocks javascript: URLs that the URL parser normalizes via the base URL', () => {
+ windowNavigate('javascript:alert(location.origin)//');
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it.each([
+ ['scheme-relative //host', '//evil.example/path'],
+ ['scheme-relative ///host', '///evil.example/path'],
+ ['backslash \\\\host', '\\\\evil.example\\path'],
+ ['mixed /\\host', '/\\evil.example/path'],
+ ['mixed \\/host', '\\/evil.example/path'],
+ ['leading-whitespace scheme-relative', ' //evil.example/path'],
+ ['leading-tab scheme-relative', '\t//evil.example/path'],
+ // Control characters the URL parser strips but `trim()` does not: each still resolves
+ // scheme-relative against the base origin, so the guard must normalize before testing.
+ ['interior-tab scheme-relative', '/\t/evil.example/path'],
+ ['interior-newline scheme-relative', '/\n/evil.example/path'],
+ ['interior-cr scheme-relative', '/\r/evil.example/path'],
+ ['interior-tab backslash', '\\\t\\evil.example/path'],
+ ['leading-null scheme-relative', '\x00//evil.example/path'],
+ ['leading-c0-controls scheme-relative', '\x01\x02//evil.example/path'],
+ ])('blocks %s and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('still rejects scheme-relative URLs when an extended allowlist is supplied', () => {
+ windowNavigate('//evil.example/path', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('honors a caller-supplied extended allowlist for custom protocols', () => {
+ windowNavigate('slack://channel/123', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('still rejects disallowed protocols when an extended allowlist is supplied', () => {
+ windowNavigate('javascript:alert(1)', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+});

.changeset/windownavigate-protocol-allowlist.md

@@ -0,0 +1,10 @@
+---
+'@clerk/clerk-js': patch
+'@clerk/react': patch
+'@clerk/shared': patch
+'@clerk/ui': patch
+---
+
+Fix missing redirect URL protocol validation for Clerk UI browser navigations, including the multi-session add-account flow.
+
+Internal browser navigations now consistently honor configured redirect protocols and fail closed across mixed ClerkJS/UI bundle versions.

packages/clerk-js/bundlewatch.config.json

@@ -2,9 +2,9 @@
  "files": [
  { "path": "./dist/clerk.js", "maxSize": "549KB" },
  { "path": "./dist/clerk.browser.js", "maxSize": "74KB" },
- { "path": "./dist/clerk.legacy.browser.js", "maxSize": "115KB" },
+ { "path": "./dist/clerk.legacy.browser.js", "maxSize": "116KB" },
  { "path": "./dist/clerk.no-rhc.js", "maxSize": "316KB" },
- { "path": "./dist/clerk.native.js", "maxSize": "73KB" },
+ { "path": "./dist/clerk.native.js", "maxSize": "74KB" },
  { "path": "./dist/vendors*.js", "maxSize": "7KB" },
  { "path": "./dist/coinbase*.js", "maxSize": "36KB" },
  { "path": "./dist/base-account-sdk*.js", "maxSize": "207KB" },

packages/clerk-js/src/core/clerk.ts

@@ -1916,7 +1916,7 @@ export class Clerk implements ClerkInterface {
 
  if (customNavigate) {
  debugLogger.info(`Clerk is navigating to: ${to}`);
- return await customNavigate(to, { windowNavigate });
+ return await customNavigate(to, { windowNavigate: this.__internal_windowNavigate });
  }
 
  // No window.location and no custom router - can't navigate
@@ -1955,13 +1955,13 @@ export class Clerk implements ClerkInterface {
 
  // Custom protocol URLs have an origin value of 'null'. In many cases, this indicates deep-linking and we want to ensure the customNavigate function is used if available.
  if ((toURL.origin !== 'null' && toURL.origin !== window.location.origin) || !customNavigate) {
-windowNavigate(toURL);
+this.__internal_windowNavigate(toURL);
  return;
  }
 
  const metadata = {
  ...(options?.metadata ? { __internal_metadata: options?.metadata } : {}),
- windowNavigate,
+ windowNavigate: this.__internal_windowNavigate,
  };
  // React router only wants the path, search or hash portion.
  return await customNavigate(stripOrigin(toURL), metadata);
@@ -3578,6 +3578,21 @@ export class Clerk implements ClerkInterface {
  return allowedProtocols;
  }
 
+ /**
+ * Primary `window.location.href` navigation chokepoint for `@clerk/clerk-js` and `@clerk/ui`.
+ * By default the resolved URL is validated against the customer-supplied
+ * `allowedRedirectProtocols` option (the static `ALLOWED_PROTOCOLS` ∪ the customer extension),
+ * so internal callers honor customer protocols automatically.
+ *
+ * Pass `useStaticAllowlistOnly: true` to opt out of the customer extension when a call site
+ * must reject any protocol the customer added. There is no current internal consumer of the
+ * opt-out; it exists for future security-critical paths.
+ */
+ public __internal_windowNavigate = (to: URL | string, opts?: { useStaticAllowlistOnly?: boolean }): void => {
+ const allowedProtocols = opts?.useStaticAllowlistOnly ? ALLOWED_PROTOCOLS : this.#allowedRedirectProtocols;
+ windowNavigate(to, { allowedProtocols });
+ };
+
  #isLoaded(): this is LoadedClerk {
  return this.client !== undefined;
  }

packages/clerk-js/src/core/resources/SignIn.ts

@@ -7,7 +7,6 @@ import {
 } from '@clerk/shared/internal/clerk-js/passkeys';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
 import { getClerkQueryParam } from '@clerk/shared/internal/clerk-js/queryParams';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptFirstFactorParams,
@@ -392,7 +391,7 @@ export class SignIn extends BaseResource implements SignInResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignIn.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (params: AuthenticateWithPopupParams): Promise<void> => {
@@ -1199,7 +1198,7 @@ class SignInFuture implements SignInFutureResource {
  // Pick up the modified SignIn resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignIn.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/clerk-js/src/core/resources/SignUp.ts

@@ -1,7 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { type ClerkError, ClerkRuntimeError, isCaptchaError, isClerkAPIResponseError } from '@clerk/shared/error';
 import { createValidatePassword } from '@clerk/shared/internal/clerk-js/passwords/password';
-import { windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { Poller } from '@clerk/shared/poller';
 import type {
  AttemptEmailAddressVerificationParams,
@@ -462,7 +461,7 @@ export class SignUp extends BaseResource implements SignUpResource {
  });
  }
 
- return this.authenticateWithRedirectOrPopup(params, windowNavigate);
+ return this.authenticateWithRedirectOrPopup(params, SignUp.clerk.__internal_windowNavigate);
  };
 
  public authenticateWithPopup = async (
@@ -1082,7 +1081,7 @@ class SignUpFuture implements SignUpFutureResource {
  // Pick up the modified SignUp resource
  await this.#resource.reload();
  } else {
-windowNavigate(externalVerificationRedirectURL);
+SignUp.clerk.__internal_windowNavigate(externalVerificationRedirectURL);
  }
  }
  });

packages/react/src/__tests__/isomorphicClerk.test.ts

@@ -434,4 +434,94 @@ describe('isomorphicClerk', () => {
  );
  });
  });
+
+ describe('__internal_windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ });
+
+ afterEach(() => {
+ Object.defineProperty(window, 'location', { configurable: true, value: originalLocation });
+ warnSpy.mockRestore();
+ });
+
+ it('delegates to clerk-js when the navigation chokepoint is available', () => {
+ const navigate = vi.fn();
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = { __internal_windowNavigate: navigate };
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in', { useStaticAllowlistOnly: true });
+
+ expect(navigate).toHaveBeenCalledWith('/sign-in', { useStaticAllowlistOnly: true });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ });
+
+ it('falls back to navigation when clerk-js is older and lacks the chokepoint', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ // An older clerk-js that does not expose __internal_windowNavigate.
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('/sign-in');
+
+ expect(hrefSetter).toHaveBeenCalledWith('https://example.com/sign-in');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback honors the customer-supplied allowedRedirectProtocols option', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123');
+
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('fallback fails closed for disallowed protocols', () => {
+ const isomorphicClerk = new IsomorphicClerk({ publishableKey: 'pk_test_XXX' });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('javascript:alert(1)');
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('fallback ignores customer protocols when useStaticAllowlistOnly is set', () => {
+ const isomorphicClerk = new IsomorphicClerk({
+ publishableKey: 'pk_test_XXX',
+ allowedRedirectProtocols: ['slack:'],
+ });
+ (isomorphicClerk as any).clerkjs = {};
+
+ isomorphicClerk.__internal_windowNavigate('slack://channel/123', { useStaticAllowlistOnly: true });
+
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+ });
 });

packages/react/src/isomorphicClerk.ts

@@ -1,5 +1,6 @@
 import { inBrowser } from '@clerk/shared/browser';
 import { clerkEvents, createClerkEventBus } from '@clerk/shared/clerkEventBus';
+import { ALLOWED_PROTOCOLS, windowNavigate } from '@clerk/shared/internal/clerk-js/windowNavigate';
 import { loadClerkJSScript, loadClerkUIScript } from '@clerk/shared/loadClerkJsScript';
 import type {
  __internal_AttemptToEnableEnvironmentSettingParams,
@@ -265,6 +266,25 @@ export class IsomorphicClerk implements IsomorphicLoadedClerk {
  return this.clerkjs?.__internal_getOption ? this.clerkjs?.__internal_getOption(key) : this.options[key];
  }
 
+ public __internal_windowNavigate: Clerk['__internal_windowNavigate'] = (to, opts) => {
+ const clerkjs = this.clerkjs;
+ if (typeof clerkjs?.__internal_windowNavigate === 'function') {
+ clerkjs.__internal_windowNavigate(to, opts);
+ return;
+ }
+
+ // Older clerk-js lacks this navigation chokepoint, so delegating would silently no-op. Fall back to
+ // the shared helper (browser-only, it touches window.location) so newer @clerk/ui still navigates and
+ // rejects disallowed protocols on an older clerk-js, honoring allowedRedirectProtocols unless opted out.
+ if (!inBrowser()) {
+ return;
+ }
+ const allowedProtocols = opts?.useStaticAllowlistOnly
+ ? ALLOWED_PROTOCOLS
+ : [...ALLOWED_PROTOCOLS, ...(this.options.allowedRedirectProtocols ?? [])];
+ windowNavigate(to, { allowedProtocols });
+ };
+
  constructor(options: IsomorphicClerkOptions) {
  this.#publishableKey = options?.publishableKey;
  this.#proxyUrl = options?.proxyUrl;

packages/shared/src/internal/clerk-js/__tests__/windowNavigate.test.ts

@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+import { ALLOWED_PROTOCOLS, CLERK_BEFORE_UNLOAD_EVENT, windowNavigate } from '../windowNavigate';
+
+describe('windowNavigate', () => {
+ let originalLocation: Location;
+ let hrefSetter: ReturnType<typeof vi.fn>;
+ let warnSpy: ReturnType<typeof vi.spyOn>;
+ let eventSpy: ReturnType<typeof vi.fn>;
+
+ beforeEach(() => {
+ originalLocation = window.location;
+ hrefSetter = vi.fn();
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: new Proxy(
+ { href: 'https://example.com/' },
+ {
+ set: (target, prop, value) => {
+ if (prop === 'href') {
+ hrefSetter(value);
+ (target as any).href = value;
+ return true;
+ }
+ (target as any)[prop] = value;
+ return true;
+ },
+ },
+ ),
+ });
+ warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+ eventSpy = vi.fn();
+ window.addEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ });
+
+ afterEach(() => {
+ window.removeEventListener(CLERK_BEFORE_UNLOAD_EVENT, eventSpy);
+ Object.defineProperty(window, 'location', {
+ configurable: true,
+ value: originalLocation,
+ });
+ warnSpy.mockRestore();
+ });
+
+ it.each([
+ ['absolute https URL', 'https://example.com/dashboard'],
+ ['absolute http URL', 'http://example.com/dashboard'],
+ ['relative path', '/sign-in'],
+ ['wails protocol', 'wails://app/route'],
+ ['chrome-extension protocol', 'chrome-extension://abc/route'],
+ ])('navigates to %s', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it.each([
+ ['javascript', 'javascript:alert(1)'],
+ ['data', 'data:text/html,<script>alert(1)</script>'],
+ ['file', 'file:///etc/passwd'],
+ ['vbscript', 'vbscript:msgbox(1)'],
+ ['mixed-case JavaScript', 'JavaScript:alert(1)'],
+ ['upper-case JAVASCRIPT', 'JAVASCRIPT:alert(1)'],
+ ['leading-whitespace javascript', ' javascript:alert(1)'],
+ ['leading-tab javascript', '\tjavascript:alert(1)'],
+ ['leading-newline javascript', '\njavascript:alert(1)'],
+ ])('blocks %s: protocol and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('blocks javascript: URLs that the URL parser normalizes via the base URL', () => {
+ windowNavigate('javascript:alert(location.origin)//');
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it.each([
+ ['scheme-relative //host', '//evil.example/path'],
+ ['scheme-relative ///host', '///evil.example/path'],
+ ['backslash \\\\host', '\\\\evil.example\\path'],
+ ['mixed /\\host', '/\\evil.example/path'],
+ ['mixed \\/host', '\\/evil.example/path'],
+ ['leading-whitespace scheme-relative', ' //evil.example/path'],
+ ['leading-tab scheme-relative', '\t//evil.example/path'],
+ // Control characters the URL parser strips but `trim()` does not: each still resolves
+ // scheme-relative against the base origin, so the guard must normalize before testing.
+ ['interior-tab scheme-relative', '/\t/evil.example/path'],
+ ['interior-newline scheme-relative', '/\n/evil.example/path'],
+ ['interior-cr scheme-relative', '/\r/evil.example/path'],
+ ['interior-tab backslash', '\\\t\\evil.example/path'],
+ ['leading-null scheme-relative', '\x00//evil.example/path'],
+ ['leading-c0-controls scheme-relative', '\x01\x02//evil.example/path'],
+ ])('blocks %s and does not navigate', (_label, to) => {
+ windowNavigate(to);
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('still rejects scheme-relative URLs when an extended allowlist is supplied', () => {
+ windowNavigate('//evil.example/path', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+
+ it('honors a caller-supplied extended allowlist for custom protocols', () => {
+ windowNavigate('slack://channel/123', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).toHaveBeenCalledTimes(1);
+ expect(hrefSetter).toHaveBeenCalledWith('slack://channel/123');
+ expect(eventSpy).toHaveBeenCalledTimes(1);
+ expect(warnSpy).not.toHaveBeenCalled();
+ });
+
+ it('still rejects disallowed protocols when an extended allowlist is supplied', () => {
+ windowNavigate('javascript:alert(1)', {
+ allowedProtocols: [...ALLOWED_PROTOCOLS, 'slack:'],
+ });
+ expect(hrefSetter).not.toHaveBeenCalled();
+ expect(eventSpy).not.toHaveBeenCalled();
+ expect(warnSpy).toHaveBeenCalledTimes(1);
+ });
+});