fix(react-router): re-resolve request options on a Request miss and cache the result

The Request-miss fallback read the resolved auth options from the shared context
and never cached its result. Under a shared context an interleaved request could
overwrite those options, so a fresh action->loader Request could authenticate with
another request's domain/proxyUrl/isSatellite (or keyless options), and repeat
getAuth calls re-authenticated each time. Stash only request-independent config
(static options + resolved keys) and re-resolve the request-derived options from
args.request on the miss, then cache the result keyed by Request.

Author: jacekradko

packages/react-router/src/server/__tests__/clerkMiddleware.authIsolation.test.ts

@@ -150,8 +150,9 @@ describe('clerkMiddleware + getAuth auth isolation', () => {
     expect(authSpy).toHaveBeenCalledTimes(1);
   });
 
-  // On a Request-instance miss (action -> loader), it re-derives exactly once.
-  it('re-derives once on a fresh Request instance', async () => {
+  // On a Request-instance miss (action -> loader) it re-derives once for that fresh
+  // Request and caches it, so repeat getAuth calls on it don't re-authenticate.
+  it('re-derives once per fresh Request and caches it', async () => {
     const authSpy = vi.fn((req: { url: string }) => Promise.resolve(fakeStateForRequest(req)));
     mockClerkClient.mockReturnValue({ authenticateRequest: authSpy } as unknown as ClerkClient);
 
@@ -163,10 +164,70 @@ describe('clerkMiddleware + getAuth auth isolation', () => {
       const loaderRequest = new Request(request.url, { headers: request.headers });
       const loaderArgs = { request: loaderRequest, context: args.context } as unknown as LoaderFunctionArgs;
       expect(await readUserId(loaderArgs)).toBe('user_A');
+      expect(await readUserId(loaderArgs)).toBe('user_A');
       return new Response('A');
     });
 
-    // middleware (1) + one re-derive for the fresh loader Request (1).
+    // middleware (1) + a single re-derive for the fresh loader Request (1); the
+    // second getAuth on that Request reused the cached result.
     expect(authSpy).toHaveBeenCalledTimes(2);
   });
+
+  // Request-derived options (e.g. a domain/proxyUrl/isSatellite function) must be
+  // resolved from each request, not read off a shared context. Here domain is
+  // derived from the URL; even when B overwrites the shared config between A's
+  // middleware and A's fresh loader Request, A must authenticate with A's domain.
+  it('re-resolves request-derived options per request on a miss (no options bleed)', async () => {
+    mockLoadOptions.mockImplementation(
+      (a: { request: Request }) =>
+        ({
+          audience: '',
+          authorizedParties: [],
+          signInUrl: '',
+          signUpUrl: '',
+          secretKey: 'sk_live_xxx',
+          publishableKey: 'pk_live_xxx',
+          domain: new URL(a.request.url).searchParams.get('u'),
+        }) as unknown as ReturnType<typeof loadOptions>,
+    );
+
+    const calls: Array<{ reqUser: string | null; domain: unknown }> = [];
+    mockClerkClient.mockReturnValue({
+      authenticateRequest: vi.fn((req: { url: string }, opts: { domain?: unknown }) => {
+        calls.push({ reqUser: new URL(req.url).searchParams.get('u'), domain: opts.domain });
+        return Promise.resolve(fakeStateForRequest(req));
+      }),
+    } as unknown as ClerkClient);
+
+    const shared = new RouterContextProvider();
+    const middleware = clerkMiddleware();
+
+    const reqA = new Request('http://app.test/?u=user_A', { method: 'POST' });
+    const argsA = { request: reqA, context: shared } as unknown as LoaderFunctionArgs;
+    const reqB = new Request('http://app.test/?u=user_B');
+    const argsB = { request: reqB, context: shared } as unknown as LoaderFunctionArgs;
+
+    let releaseA!: () => void;
+    const gateA = new Promise<void>(resolve => (releaseA = resolve));
+
+    const aDone = middleware(argsA, async () => {
+      await gateA;
+      // Fresh Request (action -> loader): misses the cache and re-derives.
+      const loaderReqA = new Request(reqA.url, { headers: reqA.headers });
+      const loaderArgsA = { request: loaderReqA, context: shared } as unknown as LoaderFunctionArgs;
+      await readUserId(loaderArgsA);
+      return new Response('A');
+    });
+
+    await flushMicrotasks();
+    await middleware(argsB, () => Promise.resolve(new Response('B')));
+    releaseA();
+    await aDone;
+
+    // Every authenticateRequest call used the domain resolved from its own request.
+    expect(calls.length).toBeGreaterThan(0);
+    for (const call of calls) {
+      expect(call.domain).toBe(call.reqUser);
+    }
+  });
 });

packages/react-router/src/server/__tests__/getAuth.test.ts

@@ -3,7 +3,7 @@ import type { LoaderFunctionArgs } from 'react-router';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { clerkClient } from '../clerkClient';
-import { requestOptionsContext } from '../clerkMiddleware';
+import { middlewareConfigContext } from '../clerkMiddleware';
 import { getAuth } from '../getAuth';
 
 vi.mock('../clerkClient');
@@ -26,7 +26,7 @@ describe('getAuth', () => {
     // the request via authenticateRequest rather than reading a cached value.
     const mockContext = {
       get: vi.fn().mockImplementation(contextKey => {
-        if (contextKey === requestOptionsContext) {
+        if (contextKey === middlewareConfigContext) {
           return { secretKey: 'sk_test_...', publishableKey: 'pk_test_...', acceptsToken: 'any' };
         }
         return null;

packages/react-router/src/server/__tests__/rootAuthLoader.test.ts

@@ -3,7 +3,7 @@ import { data, type LoaderFunctionArgs } from 'react-router';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
 import { clerkClient } from '../clerkClient';
-import { authFnContext, requestOptionsContext, requestStateContext } from '../clerkMiddleware';
+import { authFnContext, middlewareConfigContext, requestStateContext } from '../clerkMiddleware';
 import { rootAuthLoader } from '../rootAuthLoader';
 
 vi.mock('../clerkClient');
@@ -32,7 +32,7 @@ describe('rootAuthLoader', () => {
   describe('with middleware context', () => {
     const makeContext = (additionalState: Record<string, unknown> = {}) => ({
       get: vi.fn().mockImplementation(contextKey => {
-        if (contextKey === requestOptionsContext) {
+        if (contextKey === middlewareConfigContext) {
           return { secretKey: 'sk_test_...', publishableKey: 'pk_test_...', acceptsToken: 'any' };
         }
         if (contextKey === requestStateContext) {

packages/react-router/src/server/clerkMiddleware.ts

@@ -20,8 +20,12 @@ type RequestStateContextValue = {
 
 export const authFnContext = createContext<((options?: PendingSessionOptions) => AuthObject) | null>(null);
 export const requestStateContext = createContext<RequestStateContextValue | null>(null);
-// Identity-free resolved options, reused by getAuth/rootAuthLoader to re-derive the request's user.
-export const requestOptionsContext = createContext<AuthenticateRequestOptions | null>(null);
+// Request-INDEPENDENT config (the static clerkMiddleware options plus resolved keys)
+// used to re-derive auth on a Request-instance miss. It deliberately does NOT hold
+// resolved request-derived values (domain/proxyUrl/isSatellite); those are
+// re-resolved per request from args.request, so a shared context can't leak one
+// request's resolved options to another.
+export const middlewareConfigContext = createContext<ClerkMiddlewareOptions | null>(null);
 const sharedContextProbe = createContext<Request | null>(null);
 
 const sharedContextMessage =
@@ -33,31 +37,37 @@ const sharedContextMessage =
 const requestStateByRequest = new WeakMap<Request, RequestState<any>>();
 
 /**
- * Auth state for this request. Reuses what clerkMiddleware already resolved
- * (so handshake/refresh and any machine-token verification happen once per
- * request), and re-authenticates only when the Request instance differs from the
- * one the middleware saw (e.g. React Router's action -> loader revalidation).
+ * Auth state for this request. Reuses what clerkMiddleware already resolved (keyed
+ * by Request, so handshake/refresh and any machine-token verification happen once
+ * per request). On a Request-instance miss (e.g. React Router's action -> loader
+ * revalidation), it re-authenticates from this request's own cookies and caches
+ * the result so repeat calls on that Request reuse it too.
  */
 export async function resolveRequestState(args: DataFunctionArgs): Promise<RequestState<any>> {
   const cached = requestStateByRequest.get(args.request);
   if (cached) {
     return cached;
   }
 
-  // Miss: re-derive from this request's own cookies. `options` is identity-free
-  // config, so reading it from a possibly-shared context is safe; identity comes
-  // from args.request, so the result is always this request's user.
-  const options = IsOptIntoMiddleware(args.context) ? args.context.get(requestOptionsContext) : null;
-  if (!options) {
+  const config = IsOptIntoMiddleware(args.context) ? args.context.get(middlewareConfigContext) : null;
+  if (!config) {
     throw new Error(
       'Clerk: clerkMiddleware() not detected. Make sure you have installed the clerkMiddleware in your root route.',
     );
   }
 
-  return clerkClient(args, options).authenticateRequest(createClerkRequest(patchRequest(args.request)), {
-    ...options,
-    acceptsToken: 'any',
-  });
+  // Re-resolve options from THIS request: domain/proxyUrl/isSatellite are derived
+  // from args.request, and `config` carries only request-independent values (static
+  // options + resolved keys), so this can't pick up another request's resolved
+  // options even when the context is shared. Identity comes from args.request.
+  const options = loadOptions(args, config);
+  const requestState = await clerkClient(args, config).authenticateRequest(
+    createClerkRequest(patchRequest(args.request)),
+    { ...options, acceptsToken: 'any' },
+  );
+
+  requestStateByRequest.set(args.request, requestState);
+  return requestState;
 }
 
 /**
@@ -163,11 +173,21 @@ export const clerkMiddleware = (options?: ClerkMiddlewareOptions): MiddlewareFun
       signUpFallbackRedirectUrl: loadedOptions.signUpFallbackRedirectUrl,
     };
 
+    // Request-independent config (static options + resolved keys) for the re-derive
+    // fallback when the Request instance differs. Deliberately excludes resolved
+    // domain/proxyUrl/isSatellite, which are re-resolved per request from args.request.
+    const middlewareConfig: ClerkMiddlewareOptions = {
+      ...options,
+      secretKey: loadedOptions.secretKey,
+      publishableKey: loadedOptions.publishableKey,
+      jwtKey,
+      machineSecretKey,
+    };
+
     // Cache the resolved state keyed by this Request so getAuth/rootAuthLoader reuse
-    // it. Stash identity-free options for the re-derive fallback when the Request
-    // instance differs. authFnContext/requestStateContext remain for back-compat.
+    // it. authFnContext/requestStateContext remain for back-compat.
     requestStateByRequest.set(args.request, requestState);
-    args.context.set(requestOptionsContext, authenticateOptions);
+    args.context.set(middlewareConfigContext, middlewareConfig);
     args.context.set(authFnContext, (opts?: PendingSessionOptions) => requestState.toAuth(opts));
     args.context.set(requestStateContext, { requestState, additionalState });