Skip to content

fix(backend): Fix unhandled handshake error - #2541

Merged
brkalow merged 2 commits into
mainfrom
brk.fix/handshake-invalid
Jan 10, 2024
Merged

fix(backend): Fix unhandled handshake error#2541
brkalow merged 2 commits into
mainfrom
brk.fix/handshake-invalid

Conversation

@brkalow

@brkalow brkalow commented Jan 10, 2024

Copy link
Copy Markdown
Member

Description

Fixes a bug in the handshake flow that would cause an unhandled error if the handshake payload or session token in the handshake payload fails to be verified.

Checklist

  • npm test runs as expected.
  • npm run build runs as expected.
  • (If applicable) JSDoc comments have been added or updated for any package exports
  • (If applicable) Documentation has been updated

Type of change

  • 🐛 Bug fix
  • 🌟 New feature
  • 🔨 Breaking change
  • 📖 Refactoring / dependency upgrade / documentation
  • other:

Packages affected

  • @clerk/backend
  • @clerk/chrome-extension
  • @clerk/clerk-js
  • @clerk/clerk-expo
  • @clerk/fastify
  • gatsby-plugin-clerk
  • @clerk/localizations
  • @clerk/nextjs
  • @clerk/clerk-react
  • @clerk/remix
  • @clerk/clerk-sdk-node
  • @clerk/shared
  • @clerk/themes
  • @clerk/types
  • build/tooling/chore

@brkalow
brkalow requested review from a team and LekoArts and removed request for a team January 10, 2024 18:31
@changeset-bot

changeset-bot Bot commented Jan 10, 2024

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: f8a1026

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 7 packages
Name Type
@clerk/backend Patch
@clerk/fastify Patch
gatsby-plugin-clerk Patch
@clerk/nextjs Patch
@clerk/remix Patch
@clerk/clerk-sdk-node Patch
@clerk/elements Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

Comment on lines +210 to +211
// If for some reason the handshake token is invalid or stale, we ignore it and continue trying to authenticate the request.
// Worst case, the handshake will trigger again and return a refreshed token.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible that this would lead to an infinite redirect loop, if FAPI will not return a fresh token ?

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, it seems less likely that FAPI would return a stale token / invalid handshake payload though. For some reason we're seeing stale handshake cookies here, so the only solution is to move past the handshake handling and attempt to authenticate the request like normal.

@brkalow
brkalow enabled auto-merge January 10, 2024 19:00
@brkalow
brkalow added this pull request to the merge queue Jan 10, 2024
Merged via the queue into main with commit e6ecbaa Jan 10, 2024
@brkalow
brkalow deleted the brk.fix/handshake-invalid branch January 10, 2024 19:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants