fix(backend): Verify signature before claims by dominic-clerk · Pull Request #8332 · clerk/javascript

dominic-clerk · 2026-04-16T13:09:18Z

Description

By verifying the signature first we avoid leaking information about which claims are valid if the signature isn't valid to begin with. Auth couldn't be bypassed, it leaked configuration details that could aid further attacks.

Fixes SDK-61

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

vercel · 2026-04-16T13:09:24Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Apr 16, 2026 2:31pm

changeset-bot · 2026-04-16T13:09:25Z

🦋 Changeset detected

Latest commit: c8f0cca

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@clerk/backend	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-04-16T13:12:19Z

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8332

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8332

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8332

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8332

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8332

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8332

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8332

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8332

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8332

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8332

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8332

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8332

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8332

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8332

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8332

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8332

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8332

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8332

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8332

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8332

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8332

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8332

commit: c8f0cca

coderabbitai · 2026-04-16T13:13:40Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 9a5b19ef-c160-4789-bfc1-6808d3cd86b4

📥 Commits

Reviewing files that changed from the base of the PR and between 318ffa2 and c8f0cca.

📒 Files selected for processing (1)

packages/backend/src/tokens/__tests__/request.test.ts

📝 Walkthrough

Walkthrough

Signature verification in JWT verification was reordered: after header checks the code now verifies the token signature first and only performs payload claim validations (exp, nbf, iat, aud, azp, sub, etc.) after a successful signature check. If signature verification fails, signature-related errors are returned immediately. Tests were updated to use async signed JWT helpers and to assert that signature errors are reported before claim errors. One test was changed to dynamically generate a signed token missing the sub claim. A changeset bumps @clerk/backend with a patch note describing the ordering change.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: reordering verification to check signature before claims, which is the core objective of the changeset.
Description check	✅ Passed	The description is directly related to the changeset, explaining the security rationale for the signature-before-claims reordering and referencing the associated issue.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

wobsoriano

Thanks Dominic!

fix(backend): Verify signature before claims

b1e6e1a

github-actions Bot added the backend label Apr 16, 2026

dominic-clerk requested a review from wobsoriano April 16, 2026 13:11

Add test for error order

1f2866a

vercel Bot deployed to Preview April 16, 2026 13:15 View deployment

wobsoriano approved these changes Apr 16, 2026

View reviewed changes

Fix test that needed a properly signed jwt

318ffa2

dominic-clerk enabled auto-merge (squash) April 16, 2026 14:23

vercel Bot deployed to Preview April 16, 2026 14:23 View deployment

Fix linting error

c8f0cca

vercel Bot deployed to Preview April 16, 2026 14:31 View deployment

dominic-clerk merged commit 8ee6a32 into main Apr 16, 2026
71 of 72 checks passed

dominic-clerk deleted the dc-reorder-verification branch April 16, 2026 14:49

clerk-cookie mentioned this pull request Apr 15, 2026

ci(repo): Version packages #8322

Merged

Navigation Menu

Uh oh!

fix(backend): Verify signature before claims - #8332

fix(backend): Verify signature before claims#8332
dominic-clerk merged 4 commits into
mainfrom
dc-reorder-verification

dominic-clerk commented Apr 16, 2026

Uh oh!

vercel Bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Apr 16, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 16, 2026 •

edited

Loading

Walkthrough

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

wobsoriano left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dominic-clerk commented Apr 16, 2026

Description

Checklist

Type of change

Uh oh!

vercel Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

wobsoriano left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Apr 16, 2026 •

edited

Loading

changeset-bot Bot commented Apr 16, 2026 •

edited

Loading

pkg-pr-new Bot commented Apr 16, 2026 •

edited

Loading

coderabbitai Bot commented Apr 16, 2026 •

edited

Loading