fix(nextjs): allow Clerk protection origins in generated CSP#9199
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
🦋 Changeset detectedLatest commit: 0c37a56 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
API Changes Report
Summary
No API Changes DetectedAll packages have stable APIs with no detected changes. Report generated by Break Check Last ran on |
📝 WalkthroughWalkthroughAdds two Clerk protection wildcard origins to the default Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
packages/nextjs/src/server/__tests__/content-security-policy.test.ts (1)
81-90: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winCover strict CSP in the new origin assertion.
This test only calls
createContentSecurityPolicyHeaderswith{}. Sincestrict: trueremoveshttp:andhttps:fromscript-src, add the same assertions for strict headers to catch regressions in the newly added explicit origins.As per coding guidelines, unit tests should cover all new functionality and relevant edge cases.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/nextjs/src/server/__tests__/content-security-policy.test.ts` around lines 81 - 90, Extend the test around createContentSecurityPolicyHeaders to also generate headers with strict: true, then assert that script-src, connect-src, and frame-src each retain both Clerk protection origins. Keep the existing non-strict assertions unchanged and verify the strict policy’s removal of generic schemes does not remove these explicit origins.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@packages/nextjs/src/server/__tests__/content-security-policy.test.ts`:
- Around line 81-90: Extend the test around createContentSecurityPolicyHeaders
to also generate headers with strict: true, then assert that script-src,
connect-src, and frame-src each retain both Clerk protection origins. Keep the
existing non-strict assertions unchanged and verify the strict policy’s removal
of generic schemes does not remove these explicit origins.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: cb4c01a6-a880-450d-88d3-a35a72c87de6
📒 Files selected for processing (3)
.changeset/calm-dragons-protect.mdpackages/nextjs/src/server/__tests__/content-security-policy.test.tspackages/nextjs/src/server/content-security-policy.ts
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
clerk/clerk_go(manual)clerk/dashboard(manual)clerk/accounts(manual)clerk/backoffice(manual)clerk/clerk(manual) → reviewed against open PR#2986agent/update-protect-csp-docsinstead of the default branchclerk/clerk-docs(manual)clerk/cloudflare-workers(manual)
|
Addressed in 0c37a56. The protection-origin test now runs against both default and strict CSP headers, and verifies that strict mode removes the broad HTTP/HTTPS schemes while retaining both explicit Clerk protection origins in script-src, connect-src, and frame-src. The focused CSP suite passes all 38 tests; lint and formatting checks also pass. |
2 participants
Description
Clerk's generated Content Security Policy did not explicitly allow the origins used to protect applications against abuse and fraud. This meant applications relying on
clerkMiddleware()'s automatic CSP configuration could still need to add the origins manually.This adds the Clerk protection origins to the generated
script-src,connect-src, andframe-srcdirectives. They are included for every application in both the default and strict CSP modes, regardless of plan or enabled features.The focused test verifies all three directives, and the existing header assertions cover default, report-only, strict, and custom directive merging.
Paired documentation update: https://github.com/clerk/clerk/pull/2986
Related Accounts CSP update: https://github.com/clerk/cloudflare-workers/pull/2416
Testing
pnpm turbo build --filter=@clerk/nextjspnpm --filter @clerk/nextjs testpnpm --filter @clerk/nextjs lint(passes with 18 existing warnings)pnpm --filter @clerk/nextjs format:checkChecklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change