feat(clerk-js): Add debugLogger for session token swap detection#7943
Closed
jacekradko wants to merge 123 commits intomainfrom
Closed
feat(clerk-js): Add debugLogger for session token swap detection#7943jacekradko wants to merge 123 commits intomainfrom
jacekradko wants to merge 123 commits intomainfrom
Conversation
Co-authored-by: Robert Soriano <sorianorobertc@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…ure support (#7293) Signed-off-by: Kenton Duprey <kenton@clerk.dev> Co-authored-by: Dylan Staley <88163+dstaley@users.noreply.github.com>
Co-authored-by: chris-kreidl <chris-kreidl@users.noreply.github.com>
…a Solana enabled wallet via `<UserProfile />` (#7435) Signed-off-by: Kenton Duprey <kenton@clerk.dev>
…n tests (#7471) Signed-off-by: Kenton Duprey <kenton@clerk.dev>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: valentinogagliardi <valentinogagliardi@users.noreply.github.com>
…ting a compromised password (#7477)
…7500) Signed-off-by: Kenton Duprey <kenton@clerk.dev>
…with verification status (#7489) Signed-off-by: Kenton Duprey <kenton@clerk.dev>
…g creation disabled (#7502)
…r.ts, align error class naming (#7490)
…mised` as stable (#7503)
…ection Add debug logging to detect server-side token swaps in multi-session scenarios: - Session.ts: Check if returned token's sid matches requested session (token swap detection) - AuthCookieService.ts: Log multi-session cookie updates to track active session - AuthCookieService.ts: Log token fetch errors (4xx and degraded status) - clerk.ts: Log session state before unauthenticated flow to see active sessions
🦋 Changeset detectedLatest commit: ff308af The changes in this PR will be included in the next version bump. This PR includes changesets to release 11 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review infoConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Disabled knowledge base sources:
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (299)
📝 WalkthroughWalkthroughThis PR introduces a major update targeting the Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Clerk as Clerk.js Client
participant SignIn
participant Web3 as Web3/Solana
participant Backend
participant Session
User->>SignIn: Navigate to sign-in
SignIn->>Clerk: Check sign-in status
Clerk-->>SignIn: Show Web3 options
User->>SignIn: Click Solana wallet
SignIn->>Web3: Initialize Solana flow
Web3->>Web3: Detect installed wallets
User->>Web3: Select wallet
Web3->>Web3: Get wallet account
Web3->>Clerk: Generate signature
Clerk->>Backend: Authenticate with signature
Backend->>Session: Create session
Backend-->>Clerk: Session established
Clerk-->>User: Redirect to app
sequenceDiagram
participant User
participant Clerk as Clerk.js Client
participant MFATask as MFA Setup Task
participant Phone
participant TOTP
participant Backend
participant Session
User->>Clerk: Complete sign-in/sign-up
Clerk->>Session: Check if MFA required
Session-->>Clerk: MFA pending
Clerk->>MFATask: Mount MFA setup flow
MFATask->>User: Show method selection (SMS/TOTP)
User->>MFATask: Choose method
alt SMS Code Path
MFATask->>Phone: Add/select phone
Phone->>Backend: Create phone verification
Backend-->>Phone: Send verification code
User->>Phone: Enter code
Phone->>Backend: Verify code
Backend->>Session: Enable second factor
Session-->>Backend: MFA enabled
else TOTP Path
MFATask->>TOTP: Generate TOTP secret
TOTP->>User: Display QR code
User->>TOTP: Scan & verify
TOTP->>Backend: Verify TOTP code
Backend->>Session: Enable second factor
Session-->>Backend: MFA enabled
end
MFATask->>User: Show backup codes
User->>Clerk: Acknowledge
Clerk-->>User: Redirect to app
Estimated code review effort🎯 5 (Critical) | ⏱️ 90+ minutes Possibly related PRs
Suggested labels
Poem
✨ Finishing Touches
🧪 Generate unit tests (beta)
Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add debug logging to detect server-side token swaps in multi-session scenarios (e.g., regular session + impersonation session with actor token). The server-side bug is that BAPI's refresh endpoint could return a token for a different session than the one requested — we need client-side visibility to detect this.
Changes:
sidclaim doesn't match requested session ID (detects token swaps)Checklist
pnpm buildpassespnpm testruns as expected (debug logging only)Type of change
Summary by CodeRabbit
New Features
Bug Fixes
Localization