diff --git a/.changeset/polite-poems-cross.md b/.changeset/polite-poems-cross.md new file mode 100644 index 00000000000..40b7e29b147 --- /dev/null +++ b/.changeset/polite-poems-cross.md @@ -0,0 +1,5 @@ +--- +"@clerk/clerk-js": patch +--- + +Correctly use updated protocol verification in all code paths diff --git a/packages/clerk-js/src/core/clerk.ts b/packages/clerk-js/src/core/clerk.ts index d9607721469..d8463a1d5c5 100644 --- a/packages/clerk-js/src/core/clerk.ts +++ b/packages/clerk-js/src/core/clerk.ts @@ -60,6 +60,7 @@ import type { import type { MountComponentRenderer } from '../ui/Components'; import { + ALLOWED_PROTOCOLS, buildURL, completeSignUpFlow, createAllowedRedirectOrigins, @@ -782,8 +783,10 @@ export class Clerk implements ClerkInterface { let toURL = new URL(to, window.location.href); - if (toURL.protocol !== 'http:' && toURL.protocol !== 'https:') { - console.warn('Clerk: Not a valid protocol. Redirecting to /'); + if (!ALLOWED_PROTOCOLS.includes(toURL.protocol)) { + console.warn( + `Clerk: "${toURL.protocol}" is not a valid protocol. Redirecting to "/" instead. If you think this is a mistake, please open an issue.`, + ); toURL = new URL('/', window.location.href); } diff --git a/packages/clerk-js/src/utils/windowNavigate.ts b/packages/clerk-js/src/utils/windowNavigate.ts index e95a6f27999..2ebf7de9d93 100644 --- a/packages/clerk-js/src/utils/windowNavigate.ts +++ b/packages/clerk-js/src/utils/windowNavigate.ts @@ -1,6 +1,6 @@ export const CLERK_BEFORE_UNLOAD_EVENT = 'clerk:beforeunload'; -const ALLOWED_PROTOCOLS = [ +export const ALLOWED_PROTOCOLS = [ 'http:', 'https:', // Refers to https://wails.io/