Skip to content

chore(backend): Core 2 maintenance - #10722

Closed
wobsoriano wants to merge 2 commits into
release/core-2from
rob/core-2-reject-non-session-cat
Closed

wobsoriano wants to merge 2 commits into
release/core-2from
rob/core-2-reject-non-session-cat

Conversation

@wobsoriano

@wobsoriano wobsoriano commented Nov 9, 2026 •

Copy link
Copy Markdown
Member

Closed.

…re 2)

Backport of #9469 with the OIDC ID token category (cl_B7d4PD444AAA).
Tokens without a cat header are still accepted.

Refs AISEC-21
@vercel

vercel Bot commented Nov 9, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clerk-js-sandbox Ready Ready Preview Nov 9, 2026 6:49am UTC
swingset Error Error Nov 9, 2026 6:49am UTC

Request Review

@changeset-bot

changeset-bot Bot commented Nov 9, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 4ca60c5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 22 packages
Name Type
@clerk/backend Patch
@clerk/shared Patch
@clerk/agent-toolkit Patch
@clerk/astro Patch
@clerk/express Patch
@clerk/fastify Patch
@clerk/nextjs Patch
@clerk/nuxt Patch
@clerk/react-router Patch
@clerk/remix Patch
@clerk/tanstack-react-start Patch
@clerk/testing Patch
@clerk/chrome-extension Patch
@clerk/clerk-js Patch
@clerk/elements Patch
@clerk/expo-passkeys Patch
@clerk/clerk-expo Patch
@clerk/clerk-react Patch
@clerk/themes Patch
@clerk/types Patch
@clerk/vue Patch
@clerk/localizations Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai

coderabbitai Bot commented Nov 9, 2026 •

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

@blacksmith-sh

blacksmith-sh Bot commented Nov 9, 2026 •

Copy link
Copy Markdown

Matches Header token with non-session cat is signed out

JWT template, M2M and OIDC category tokens in the Authorization header signed in before and are signed out with token-type-mismatch after, with default options, acceptsToken 'any' and an acceptsToken array.

Merge-base

Header tokens before

This PR 4ca60c58

Header tokens after

Also checked · 3 match

Matches Cookie token with non-session cat is signed out
Matches Handshake rejects non-session cat
Matches No cat or session cat still accepted

Proof on 4ca60c58 (from 7f58aa58) · Did Proof get it right? Yes · No

View full Proof report

@pkg-pr-new

pkg-pr-new Bot commented Nov 9, 2026

Copy link
Copy Markdown

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@10722

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10722

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10722

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10722

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10722

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@10722

@clerk/elements

npm i https://pkg.pr.new/@clerk/elements@10722

@clerk/clerk-expo

npm i https://pkg.pr.new/@clerk/clerk-expo@10722

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10722

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10722

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10722

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10722

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10722

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10722

@clerk/clerk-react

npm i https://pkg.pr.new/@clerk/clerk-react@10722

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10722

@clerk/remix

npm i https://pkg.pr.new/@clerk/remix@10722

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10722

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10722

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10722

@clerk/themes

npm i https://pkg.pr.new/@clerk/themes@10722

@clerk/types

npm i https://pkg.pr.new/@clerk/types@10722

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10722

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10722

commit: 4ca60c5

@wobsoriano wobsoriano closed this Nov 9, 2026
@wobsoriano wobsoriano changed the title fix(backend): Reject non-session JWT categories as session tokens (Core 2) chore(backend): Core 2 maintenance Nov 9, 2026
@wobsoriano
wobsoriano deleted the rob/core-2-reject-non-session-cat branch November 9, 2026 06:54

This branch had an error being deployed

1 failed and 1 active deployments
Preview – clerk-js-sandbox — 4ca60c58 Deployed Nov 9, 2026 by vercel[bot]
Preview – swingset — 4ca60c58 Deployed Nov 9, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant