fix(tanstack-react-start): Apply response headers#6057
Merged
Conversation
🦋 Changeset detectedLatest commit: f15fc4f The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
@dios-david is attempting to deploy a commit to the Clerk Production Team on Vercel. A member of the Team first needs to authorize it. |
Contributor
Author
|
Hi @octoper, tagging you as I saw that you contributed the most to this package. Can you take a look at this please? |
wobsoriano
changed the title
wobsoriano
approved these changes
Jun 4, 2025
wobsoriano
left a comment
wobsoriano
left a comment
Member
There was a problem hiding this comment.
Awesome catch, thank you for the PR!
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/elements
@clerk/clerk-expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/clerk-react
@clerk/react-router
@clerk/remix
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/themes
@clerk/types
@clerk/upgrade
@clerk/vue
commit: |
Contributor
Author
|
@wobsoriano 🙌 |
tmilewski
approved these changes
Jun 4, 2025
1 task
thaohienhomes
added a commit
to thaohienhomes/pho-chat-v1
that referenced
this pull request
Jun 16, 2026
…ken 401) (#76) Root cause of the production auth incident where signed-in users (incognito 100%, normal browser intermittently) get 401 on every Clerk-cookie-authed endpoint (tRPC /trpc/lambda/*, /api/subscription/usage-stats + models/allowed), which greys out PRO/flagship models in the picker. Vercel logs show `[ClerkAuth] signed-in client but no userId resolved` with reason `client-uat-but-no-session-token`, status `signed-out`: the client has `__client_uat` (signed in) but the `__session` token is never established, so `authenticateRequest()` resolves no userId → tRPC UNAUTHORIZED / route 401. The cause is the middleware's locale/variant `NextResponse.rewrite()`. When Clerk redirects back with its handshake nonce (`__clerk_handshake`), clerkMiddleware must set the session cookies and 307-redirect to the clean URL — but Next.js ignores a `Location` header once `x-middleware-rewrite` is set, so the rewrite swallows the handshake and `__session` is never set. The chat endpoint is unaffected because it authenticates via the header token, not the cookie. Fix: in defaultMiddleware, skip the rewrite (return NextResponse.next()) when the request carries a Clerk handshake param, so Clerk fully owns the handshake round-trip. Ref: clerk/javascript#6057. Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
I'm using
@tanstack/react-start@1.120.15and@clerk/tanstack-react-start@0.15.8in a project and I noticed that the Clerk response headers are not being set on the response, which is needed for some key functionalities (e.g. for the handshake).I noticed that the
getResponseClerkState()function already returns the headers, and they are added torouter.update(), but this doesn't seem to work.I applied these changes to my local project and I can confirm that I see the response headers now (
x-clerk-auth-reasonandx-clerk-auth-statuswhen not logged in), but I'm not sure what is the best way to fully verify this - I added a test case to the integration tests but I don't have access to run them.Any feedback or help would be much appreciated!
Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change