fix(nextjs): remove redundant protection CSP source

[mwickett]

Description

The CSP generated by clerkMiddleware() currently lists https://*.protect.clerk.com and https://*.client.protect.clerk.com separately for script-src, connect-src, and frame-src.

CSP wildcard source matching means https://*.protect.clerk.com already covers the nested client Protect hosts. This removes only the redundant https://*.client.protect.clerk.com source while retaining the Protect-scoped wildcard.

This follows up #9199 after its release in @clerk/nextjs@7.5.21.

Paired documentation update: https://github.com/clerk/clerk/pull/2986

Impact

Applications that use automatic Next.js CSP configuration retain https://*.protect.clerk.com and no longer receive the redundant deeper client source. No application configuration changes are required.

Testing

• pnpm turbo build --filter=@clerk/nextjs
• pnpm --filter @clerk/nextjs test (44 files, 471 tests)
• pnpm --filter @clerk/nextjs lint (passes with 18 existing warnings)
• pnpm --filter @clerk/nextjs format:check
• pnpm changeset status --since origin/main
• git diff --check

[changeset-bot]

🦋 Changeset detected

Latest commit: 4eb82e6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@clerk/nextjs	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Jul 21, 2026 7:38pm
swingset	Ready	Preview, Comment	Jul 21, 2026 7:38pm

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9207

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9207

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9207

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9207

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9207

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9207

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9207

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9207

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9207

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9207

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9207

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9207

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9207

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9207

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9207

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9207

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9207

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9207

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9207

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9207

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9207

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9207

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9207

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9207

commit: 4eb82e6

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 7720ca6b-0cff-4f42-8dcf-8c8b1f7b136a

📥 Commits

Reviewing files that changed from the base of the PR and between 237748d and 4eb82e6.

📒 Files selected for processing (3)

• .changeset/swift-plums-cover.md
• packages/nextjs/src/server/__tests__/content-security-policy.test.ts
• packages/nextjs/src/server/content-security-policy.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual) → reviewed against open PR #2986 agent/update-protect-csp-docs instead of the default branch
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)

---

📝 Walkthrough

Walkthrough

The Next.js CSP generator now uses a single https://*.protect.clerk.com origin instead of including the redundant client protection origin. CSP tests were updated across default, report-only, merged, converted, and custom directive scenarios to verify the revised source lists. A patch changeset documents the middleware CSP change.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• clerk/javascript#9199: Updates the same CSP generation and test logic with conflicting Clerk protection-origin changes.

Suggested reviewers: wobsoriano

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: removing a redundant Clerk protection CSP source in Next.js.
Description check	✅ Passed	The description is directly related to the CSP update and accurately explains the removed redundant source and impact.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

API Changes Report

Generated by Break Check on 2026-07-21T19:40:55.458Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

---

Report generated by Break Check

_{Last ran on 4eb82e6.}

[wobsoriano]

thanks!