fix(backend): Do not throw URIError when a cookie has a malformed percent-escape

.changeset/kind-rooms-report.md

@@ -0,0 +1,9 @@
+---
+'@clerk/backend': patch
+---
+
+Fix `URIError: URI malformed` being thrown while parsing the `Cookie` header.
+
+`ClerkRequest` decodes percent-escapes across the whole header rather than per value, so an invalid sequence in any cookie — including ones Clerk neither set nor reads, such as those written by analytics or third-party scripts — reached `decodeURIComponent` and threw. The decode runs from the constructor, so the error escaped `createClerkRequest` and failed the request before any auth logic ran. Because the offending value stays in the browser until it expires, every subsequent request from that client failed too.
+
+Escape sequences that cannot be decoded are now left as their raw text, and the rest of the header parses as before.

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -97,6 +97,30 @@ describe('createClerkRequest', () => {
  expect(req.cookies.get('baz')).toBe('qux');
  });
 
+ // `%E2` is an incomplete UTF-8 lead byte, so `decodeURIComponent` throws on it.
+ // The decode runs over the whole header, so a cookie Clerk never set and never
+ // reads can fail the request before any auth logic runs (issue #9333).
+ it('does not throw when another cookie has a malformed percent-escape', () => {
+ const req = new Request('http://localhost:3000', {
+ headers: new Headers({ cookie: '__session=abc; analytics_id=%E2%9' }),
+ });
+ expect(() => createClerkRequest(req)).not.toThrow();
+ expect(createClerkRequest(req).cookies.get('__session')).toBe('abc');
+ });
+
+ // A value that cannot be decoded is kept as-is, so callers still see whatever
+ // the client sent rather than an empty or dropped cookie.
+ it.each([
+ ['truncated sequence', '%E2%9'],
+ ['lone continuation byte', '%98'],
+ ['overlong encoding', '%C0%80'],
+ ])('leaves a cookie with a %s undecoded', (_label, value) => {
+ const req = createClerkRequest(
+ new Request('http://localhost:3000', { headers: new Headers({ cookie: `analytics_id=${value}` }) }),
+ );
+ expect(req.cookies.get('analytics_id')).toBe(value);
+ });
+
  it('should parse and return cookies even if no cookie header exists', () => {
  const req = createClerkRequest(new Request('http://localhost:3000', { headers: new Headers() }));
  expect(req.cookies.get('foo')).toBeUndefined();

packages/backend/src/tokens/clerkRequest.ts

@@ -99,7 +99,22 @@ class ClerkRequest extends Request {
  }
 
  private decodeCookieValue(str: string) {
- return str ? str.replace(/(%[0-9A-Z]{2})+/g, decodeURIComponent) : str;
+ if (!str) {
+ return str;
+ }
+
+ // The decode runs over the whole header rather than per value, so an escape
+ // in any cookie - including ones Clerk neither set nor reads - reaches
+ // `decodeURIComponent`, which throws on invalid UTF-8 (truncated, lone, or
+ // overlong sequences). This is called from the constructor, so that would
+ // fail the request before any auth logic runs. Leave such runs raw instead.
+ return str.replace(/(%[0-9A-Z]{2})+/g, match => {
+ try {
+ return decodeURIComponent(match);
+ } catch {
+ return match;
+ }
+ });
  }
 }
 

.changeset/kind-rooms-report.md

@@ -0,0 +1,9 @@
+---
+'@clerk/backend': patch
+---
+
+Fix `URIError: URI malformed` being thrown while parsing the `Cookie` header.
+
+`ClerkRequest` decodes percent-escapes across the whole header rather than per value, so an invalid sequence in any cookie — including ones Clerk neither set nor reads, such as those written by analytics or third-party scripts — reached `decodeURIComponent` and threw. The decode runs from the constructor, so the error escaped `createClerkRequest` and failed the request before any auth logic ran. Because the offending value stays in the browser until it expires, every subsequent request from that client failed too.
+
+Escape sequences that cannot be decoded are now left as their raw text, and the rest of the header parses as before.

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -97,6 +97,30 @@ describe('createClerkRequest', () => {
  expect(req.cookies.get('baz')).toBe('qux');
  });
 
+ // `%E2` is an incomplete UTF-8 lead byte, so `decodeURIComponent` throws on it.
+ // The decode runs over the whole header, so a cookie Clerk never set and never
+ // reads can fail the request before any auth logic runs (issue #9333).
+ it('does not throw when another cookie has a malformed percent-escape', () => {
+ const req = new Request('http://localhost:3000', {
+ headers: new Headers({ cookie: '__session=abc; analytics_id=%E2%9' }),
+ });
+ expect(() => createClerkRequest(req)).not.toThrow();
+ expect(createClerkRequest(req).cookies.get('__session')).toBe('abc');
+ });
+
+ // A value that cannot be decoded is kept as-is, so callers still see whatever
+ // the client sent rather than an empty or dropped cookie.
+ it.each([
+ ['truncated sequence', '%E2%9'],
+ ['lone continuation byte', '%98'],
+ ['overlong encoding', '%C0%80'],
+ ])('leaves a cookie with a %s undecoded', (_label, value) => {
+ const req = createClerkRequest(
+ new Request('http://localhost:3000', { headers: new Headers({ cookie: `analytics_id=${value}` }) }),
+ );
+ expect(req.cookies.get('analytics_id')).toBe(value);
+ });
+
  it('should parse and return cookies even if no cookie header exists', () => {
  const req = createClerkRequest(new Request('http://localhost:3000', { headers: new Headers() }));
  expect(req.cookies.get('foo')).toBeUndefined();

packages/backend/src/tokens/clerkRequest.ts

@@ -99,7 +99,22 @@ class ClerkRequest extends Request {
  }
 
  private decodeCookieValue(str: string) {
- return str ? str.replace(/(%[0-9A-Z]{2})+/g, decodeURIComponent) : str;
+ if (!str) {
+ return str;
+ }
+
+ // The decode runs over the whole header rather than per value, so an escape
+ // in any cookie - including ones Clerk neither set nor reads - reaches
+ // `decodeURIComponent`, which throws on invalid UTF-8 (truncated, lone, or
+ // overlong sequences). This is called from the constructor, so that would
+ // fail the request before any auth logic runs. Leave such runs raw instead.
+ return str.replace(/(%[0-9A-Z]{2})+/g, match => {
+ try {
+ return decodeURIComponent(match);
+ } catch {
+ return match;
+ }
+ });
  }
 }
 

.changeset/kind-rooms-report.md

@@ -0,0 +1,9 @@
+---
+'@clerk/backend': patch
+---
+
+Fix `URIError: URI malformed` being thrown while parsing the `Cookie` header.
+
+`ClerkRequest` decodes percent-escapes across the whole header rather than per value, so an invalid sequence in any cookie — including ones Clerk neither set nor reads, such as those written by analytics or third-party scripts — reached `decodeURIComponent` and threw. The decode runs from the constructor, so the error escaped `createClerkRequest` and failed the request before any auth logic ran. Because the offending value stays in the browser until it expires, every subsequent request from that client failed too.
+
+Escape sequences that cannot be decoded are now left as their raw text, and the rest of the header parses as before.

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -97,6 +97,30 @@ describe('createClerkRequest', () => {
  expect(req.cookies.get('baz')).toBe('qux');
  });
 
+ // `%E2` is an incomplete UTF-8 lead byte, so `decodeURIComponent` throws on it.
+ // The decode runs over the whole header, so a cookie Clerk never set and never
+ // reads can fail the request before any auth logic runs (issue #9333).
+ it('does not throw when another cookie has a malformed percent-escape', () => {
+ const req = new Request('http://localhost:3000', {
+ headers: new Headers({ cookie: '__session=abc; analytics_id=%E2%9' }),
+ });
+ expect(() => createClerkRequest(req)).not.toThrow();
+ expect(createClerkRequest(req).cookies.get('__session')).toBe('abc');
+ });
+
+ // A value that cannot be decoded is kept as-is, so callers still see whatever
+ // the client sent rather than an empty or dropped cookie.
+ it.each([
+ ['truncated sequence', '%E2%9'],
+ ['lone continuation byte', '%98'],
+ ['overlong encoding', '%C0%80'],
+ ])('leaves a cookie with a %s undecoded', (_label, value) => {
+ const req = createClerkRequest(
+ new Request('http://localhost:3000', { headers: new Headers({ cookie: `analytics_id=${value}` }) }),
+ );
+ expect(req.cookies.get('analytics_id')).toBe(value);
+ });
+
  it('should parse and return cookies even if no cookie header exists', () => {
  const req = createClerkRequest(new Request('http://localhost:3000', { headers: new Headers() }));
  expect(req.cookies.get('foo')).toBeUndefined();

packages/backend/src/tokens/clerkRequest.ts

@@ -99,7 +99,22 @@ class ClerkRequest extends Request {
  }
 
  private decodeCookieValue(str: string) {
- return str ? str.replace(/(%[0-9A-Z]{2})+/g, decodeURIComponent) : str;
+ if (!str) {
+ return str;
+ }
+
+ // The decode runs over the whole header rather than per value, so an escape
+ // in any cookie - including ones Clerk neither set nor reads - reaches
+ // `decodeURIComponent`, which throws on invalid UTF-8 (truncated, lone, or
+ // overlong sequences). This is called from the constructor, so that would
+ // fail the request before any auth logic runs. Leave such runs raw instead.
+ return str.replace(/(%[0-9A-Z]{2})+/g, match => {
+ try {
+ return decodeURIComponent(match);
+ } catch {
+ return match;
+ }
+ });
  }
 }
 

.changeset/kind-rooms-report.md

@@ -0,0 +1,9 @@
+---
+'@clerk/backend': patch
+---
+
+Fix `URIError: URI malformed` being thrown while parsing the `Cookie` header.
+
+`ClerkRequest` decodes percent-escapes across the whole header rather than per value, so an invalid sequence in any cookie — including ones Clerk neither set nor reads, such as those written by analytics or third-party scripts — reached `decodeURIComponent` and threw. The decode runs from the constructor, so the error escaped `createClerkRequest` and failed the request before any auth logic ran. Because the offending value stays in the browser until it expires, every subsequent request from that client failed too.
+
+Escape sequences that cannot be decoded are now left as their raw text, and the rest of the header parses as before.

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -97,6 +97,30 @@ describe('createClerkRequest', () => {
  expect(req.cookies.get('baz')).toBe('qux');
  });
 
+ // `%E2` is an incomplete UTF-8 lead byte, so `decodeURIComponent` throws on it.
+ // The decode runs over the whole header, so a cookie Clerk never set and never
+ // reads can fail the request before any auth logic runs (issue #9333).
+ it('does not throw when another cookie has a malformed percent-escape', () => {
+ const req = new Request('http://localhost:3000', {
+ headers: new Headers({ cookie: '__session=abc; analytics_id=%E2%9' }),
+ });
+ expect(() => createClerkRequest(req)).not.toThrow();
+ expect(createClerkRequest(req).cookies.get('__session')).toBe('abc');
+ });
+
+ // A value that cannot be decoded is kept as-is, so callers still see whatever
+ // the client sent rather than an empty or dropped cookie.
+ it.each([
+ ['truncated sequence', '%E2%9'],
+ ['lone continuation byte', '%98'],
+ ['overlong encoding', '%C0%80'],
+ ])('leaves a cookie with a %s undecoded', (_label, value) => {
+ const req = createClerkRequest(
+ new Request('http://localhost:3000', { headers: new Headers({ cookie: `analytics_id=${value}` }) }),
+ );
+ expect(req.cookies.get('analytics_id')).toBe(value);
+ });
+
  it('should parse and return cookies even if no cookie header exists', () => {
  const req = createClerkRequest(new Request('http://localhost:3000', { headers: new Headers() }));
  expect(req.cookies.get('foo')).toBeUndefined();

packages/backend/src/tokens/clerkRequest.ts

@@ -99,7 +99,22 @@ class ClerkRequest extends Request {
  }
 
  private decodeCookieValue(str: string) {
- return str ? str.replace(/(%[0-9A-Z]{2})+/g, decodeURIComponent) : str;
+ if (!str) {
+ return str;
+ }
+
+ // The decode runs over the whole header rather than per value, so an escape
+ // in any cookie - including ones Clerk neither set nor reads - reaches
+ // `decodeURIComponent`, which throws on invalid UTF-8 (truncated, lone, or
+ // overlong sequences). This is called from the constructor, so that would
+ // fail the request before any auth logic runs. Leave such runs raw instead.
+ return str.replace(/(%[0-9A-Z]{2})+/g, match => {
+ try {
+ return decodeURIComponent(match);
+ } catch {
+ return match;
+ }
+ });
  }
 }
 

.changeset/kind-rooms-report.md

@@ -0,0 +1,9 @@
+---
+'@clerk/backend': patch
+---
+
+Fix `URIError: URI malformed` being thrown while parsing the `Cookie` header.
+
+`ClerkRequest` decodes percent-escapes across the whole header rather than per value, so an invalid sequence in any cookie — including ones Clerk neither set nor reads, such as those written by analytics or third-party scripts — reached `decodeURIComponent` and threw. The decode runs from the constructor, so the error escaped `createClerkRequest` and failed the request before any auth logic ran. Because the offending value stays in the browser until it expires, every subsequent request from that client failed too.
+
+Escape sequences that cannot be decoded are now left as their raw text, and the rest of the header parses as before.

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -97,6 +97,30 @@ describe('createClerkRequest', () => {
  expect(req.cookies.get('baz')).toBe('qux');
  });
 
+ // `%E2` is an incomplete UTF-8 lead byte, so `decodeURIComponent` throws on it.
+ // The decode runs over the whole header, so a cookie Clerk never set and never
+ // reads can fail the request before any auth logic runs (issue #9333).
+ it('does not throw when another cookie has a malformed percent-escape', () => {
+ const req = new Request('http://localhost:3000', {
+ headers: new Headers({ cookie: '__session=abc; analytics_id=%E2%9' }),
+ });
+ expect(() => createClerkRequest(req)).not.toThrow();
+ expect(createClerkRequest(req).cookies.get('__session')).toBe('abc');
+ });
+
+ // A value that cannot be decoded is kept as-is, so callers still see whatever
+ // the client sent rather than an empty or dropped cookie.
+ it.each([
+ ['truncated sequence', '%E2%9'],
+ ['lone continuation byte', '%98'],
+ ['overlong encoding', '%C0%80'],
+ ])('leaves a cookie with a %s undecoded', (_label, value) => {
+ const req = createClerkRequest(
+ new Request('http://localhost:3000', { headers: new Headers({ cookie: `analytics_id=${value}` }) }),
+ );
+ expect(req.cookies.get('analytics_id')).toBe(value);
+ });
+
  it('should parse and return cookies even if no cookie header exists', () => {
  const req = createClerkRequest(new Request('http://localhost:3000', { headers: new Headers() }));
  expect(req.cookies.get('foo')).toBeUndefined();

packages/backend/src/tokens/clerkRequest.ts

@@ -99,7 +99,22 @@ class ClerkRequest extends Request {
  }
 
  private decodeCookieValue(str: string) {
- return str ? str.replace(/(%[0-9A-Z]{2})+/g, decodeURIComponent) : str;
+ if (!str) {
+ return str;
+ }
+
+ // The decode runs over the whole header rather than per value, so an escape
+ // in any cookie - including ones Clerk neither set nor reads - reaches
+ // `decodeURIComponent`, which throws on invalid UTF-8 (truncated, lone, or
+ // overlong sequences). This is called from the constructor, so that would
+ // fail the request before any auth logic runs. Leave such runs raw instead.
+ return str.replace(/(%[0-9A-Z]{2})+/g, match => {
+ try {
+ return decodeURIComponent(match);
+ } catch {
+ return match;
+ }
+ });
  }
 }
 

.changeset/kind-rooms-report.md

@@ -0,0 +1,9 @@
+---
+'@clerk/backend': patch
+---
+
+Fix `URIError: URI malformed` being thrown while parsing the `Cookie` header.
+
+`ClerkRequest` decodes percent-escapes across the whole header rather than per value, so an invalid sequence in any cookie — including ones Clerk neither set nor reads, such as those written by analytics or third-party scripts — reached `decodeURIComponent` and threw. The decode runs from the constructor, so the error escaped `createClerkRequest` and failed the request before any auth logic ran. Because the offending value stays in the browser until it expires, every subsequent request from that client failed too.
+
+Escape sequences that cannot be decoded are now left as their raw text, and the rest of the header parses as before.

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -97,6 +97,30 @@ describe('createClerkRequest', () => {
  expect(req.cookies.get('baz')).toBe('qux');
  });
 
+ // `%E2` is an incomplete UTF-8 lead byte, so `decodeURIComponent` throws on it.
+ // The decode runs over the whole header, so a cookie Clerk never set and never
+ // reads can fail the request before any auth logic runs (issue #9333).
+ it('does not throw when another cookie has a malformed percent-escape', () => {
+ const req = new Request('http://localhost:3000', {
+ headers: new Headers({ cookie: '__session=abc; analytics_id=%E2%9' }),
+ });
+ expect(() => createClerkRequest(req)).not.toThrow();
+ expect(createClerkRequest(req).cookies.get('__session')).toBe('abc');
+ });
+
+ // A value that cannot be decoded is kept as-is, so callers still see whatever
+ // the client sent rather than an empty or dropped cookie.
+ it.each([
+ ['truncated sequence', '%E2%9'],
+ ['lone continuation byte', '%98'],
+ ['overlong encoding', '%C0%80'],
+ ])('leaves a cookie with a %s undecoded', (_label, value) => {
+ const req = createClerkRequest(
+ new Request('http://localhost:3000', { headers: new Headers({ cookie: `analytics_id=${value}` }) }),
+ );
+ expect(req.cookies.get('analytics_id')).toBe(value);
+ });
+
  it('should parse and return cookies even if no cookie header exists', () => {
  const req = createClerkRequest(new Request('http://localhost:3000', { headers: new Headers() }));
  expect(req.cookies.get('foo')).toBeUndefined();

packages/backend/src/tokens/clerkRequest.ts

@@ -99,7 +99,22 @@ class ClerkRequest extends Request {
  }
 
  private decodeCookieValue(str: string) {
- return str ? str.replace(/(%[0-9A-Z]{2})+/g, decodeURIComponent) : str;
+ if (!str) {
+ return str;
+ }
+
+ // The decode runs over the whole header rather than per value, so an escape
+ // in any cookie - including ones Clerk neither set nor reads - reaches
+ // `decodeURIComponent`, which throws on invalid UTF-8 (truncated, lone, or
+ // overlong sequences). This is called from the constructor, so that would
+ // fail the request before any auth logic runs. Leave such runs raw instead.
+ return str.replace(/(%[0-9A-Z]{2})+/g, match => {
+ try {
+ return decodeURIComponent(match);
+ } catch {
+ return match;
+ }
+ });
  }
 }
 

.changeset/kind-rooms-report.md

@@ -0,0 +1,9 @@
+---
+'@clerk/backend': patch
+---
+
+Fix `URIError: URI malformed` being thrown while parsing the `Cookie` header.
+
+`ClerkRequest` decodes percent-escapes across the whole header rather than per value, so an invalid sequence in any cookie — including ones Clerk neither set nor reads, such as those written by analytics or third-party scripts — reached `decodeURIComponent` and threw. The decode runs from the constructor, so the error escaped `createClerkRequest` and failed the request before any auth logic ran. Because the offending value stays in the browser until it expires, every subsequent request from that client failed too.
+
+Escape sequences that cannot be decoded are now left as their raw text, and the rest of the header parses as before.

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -97,6 +97,30 @@ describe('createClerkRequest', () => {
  expect(req.cookies.get('baz')).toBe('qux');
  });
 
+ // `%E2` is an incomplete UTF-8 lead byte, so `decodeURIComponent` throws on it.
+ // The decode runs over the whole header, so a cookie Clerk never set and never
+ // reads can fail the request before any auth logic runs (issue #9333).
+ it('does not throw when another cookie has a malformed percent-escape', () => {
+ const req = new Request('http://localhost:3000', {
+ headers: new Headers({ cookie: '__session=abc; analytics_id=%E2%9' }),
+ });
+ expect(() => createClerkRequest(req)).not.toThrow();
+ expect(createClerkRequest(req).cookies.get('__session')).toBe('abc');
+ });
+
+ // A value that cannot be decoded is kept as-is, so callers still see whatever
+ // the client sent rather than an empty or dropped cookie.
+ it.each([
+ ['truncated sequence', '%E2%9'],
+ ['lone continuation byte', '%98'],
+ ['overlong encoding', '%C0%80'],
+ ])('leaves a cookie with a %s undecoded', (_label, value) => {
+ const req = createClerkRequest(
+ new Request('http://localhost:3000', { headers: new Headers({ cookie: `analytics_id=${value}` }) }),
+ );
+ expect(req.cookies.get('analytics_id')).toBe(value);
+ });
+
  it('should parse and return cookies even if no cookie header exists', () => {
  const req = createClerkRequest(new Request('http://localhost:3000', { headers: new Headers() }));
  expect(req.cookies.get('foo')).toBeUndefined();

packages/backend/src/tokens/clerkRequest.ts

@@ -99,7 +99,22 @@ class ClerkRequest extends Request {
  }
 
  private decodeCookieValue(str: string) {
- return str ? str.replace(/(%[0-9A-Z]{2})+/g, decodeURIComponent) : str;
+ if (!str) {
+ return str;
+ }
+
+ // The decode runs over the whole header rather than per value, so an escape
+ // in any cookie - including ones Clerk neither set nor reads - reaches
+ // `decodeURIComponent`, which throws on invalid UTF-8 (truncated, lone, or
+ // overlong sequences). This is called from the constructor, so that would
+ // fail the request before any auth logic runs. Leave such runs raw instead.
+ return str.replace(/(%[0-9A-Z]{2})+/g, match => {
+ try {
+ return decodeURIComponent(match);
+ } catch {
+ return match;
+ }
+ });
  }
 }
 

.changeset/kind-rooms-report.md

@@ -0,0 +1,9 @@
+---
+'@clerk/backend': patch
+---
+
+Fix `URIError: URI malformed` being thrown while parsing the `Cookie` header.
+
+`ClerkRequest` decodes percent-escapes across the whole header rather than per value, so an invalid sequence in any cookie — including ones Clerk neither set nor reads, such as those written by analytics or third-party scripts — reached `decodeURIComponent` and threw. The decode runs from the constructor, so the error escaped `createClerkRequest` and failed the request before any auth logic ran. Because the offending value stays in the browser until it expires, every subsequent request from that client failed too.
+
+Escape sequences that cannot be decoded are now left as their raw text, and the rest of the header parses as before.

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -97,6 +97,30 @@ describe('createClerkRequest', () => {
  expect(req.cookies.get('baz')).toBe('qux');
  });
 
+ // `%E2` is an incomplete UTF-8 lead byte, so `decodeURIComponent` throws on it.
+ // The decode runs over the whole header, so a cookie Clerk never set and never
+ // reads can fail the request before any auth logic runs (issue #9333).
+ it('does not throw when another cookie has a malformed percent-escape', () => {
+ const req = new Request('http://localhost:3000', {
+ headers: new Headers({ cookie: '__session=abc; analytics_id=%E2%9' }),
+ });
+ expect(() => createClerkRequest(req)).not.toThrow();
+ expect(createClerkRequest(req).cookies.get('__session')).toBe('abc');
+ });
+
+ // A value that cannot be decoded is kept as-is, so callers still see whatever
+ // the client sent rather than an empty or dropped cookie.
+ it.each([
+ ['truncated sequence', '%E2%9'],
+ ['lone continuation byte', '%98'],
+ ['overlong encoding', '%C0%80'],
+ ])('leaves a cookie with a %s undecoded', (_label, value) => {
+ const req = createClerkRequest(
+ new Request('http://localhost:3000', { headers: new Headers({ cookie: `analytics_id=${value}` }) }),
+ );
+ expect(req.cookies.get('analytics_id')).toBe(value);
+ });
+
  it('should parse and return cookies even if no cookie header exists', () => {
  const req = createClerkRequest(new Request('http://localhost:3000', { headers: new Headers() }));
  expect(req.cookies.get('foo')).toBeUndefined();

packages/backend/src/tokens/clerkRequest.ts

@@ -99,7 +99,22 @@ class ClerkRequest extends Request {
  }
 
  private decodeCookieValue(str: string) {
- return str ? str.replace(/(%[0-9A-Z]{2})+/g, decodeURIComponent) : str;
+ if (!str) {
+ return str;
+ }
+
+ // The decode runs over the whole header rather than per value, so an escape
+ // in any cookie - including ones Clerk neither set nor reads - reaches
+ // `decodeURIComponent`, which throws on invalid UTF-8 (truncated, lone, or
+ // overlong sequences). This is called from the constructor, so that would
+ // fail the request before any auth logic runs. Leave such runs raw instead.
+ return str.replace(/(%[0-9A-Z]{2})+/g, match => {
+ try {
+ return decodeURIComponent(match);
+ } catch {
+ return match;
+ }
+ });
  }
 }