diff --git a/.changeset/lucky-showers-guess.md b/.changeset/lucky-showers-guess.md new file mode 100644 index 00000000000..3a21df15d8d --- /dev/null +++ b/.changeset/lucky-showers-guess.md @@ -0,0 +1,5 @@ +--- +'@clerk/clerk-js': patch +--- + +Update active context cookie to properly set `Secure` attribute. diff --git a/packages/clerk-js/src/core/auth/AuthCookieService.ts b/packages/clerk-js/src/core/auth/AuthCookieService.ts index 6cbdd8207e7..932b639b1ba 100644 --- a/packages/clerk-js/src/core/auth/AuthCookieService.ts +++ b/packages/clerk-js/src/core/auth/AuthCookieService.ts @@ -1,6 +1,6 @@ import type { createClerkEventBus } from '@clerk/shared/clerkEventBus'; import { clerkEvents } from '@clerk/shared/clerkEventBus'; -import { createCookieHandler } from '@clerk/shared/cookie'; +import type { createCookieHandler } from '@clerk/shared/cookie'; import { setDevBrowserJWTInURL } from '@clerk/shared/devBrowser'; import { is4xxError, isClerkAPIResponseError, isClerkRuntimeError, isNetworkError } from '@clerk/shared/error'; import { noop } from '@clerk/shared/utils'; @@ -9,6 +9,7 @@ import type { Clerk, InstanceType } from '@clerk/types'; import { clerkMissingDevBrowserJwt } from '../errors'; import { eventBus, events } from '../events'; import type { FapiClient } from '../fapiClient'; +import { createActiveContextCookie } from './cookies/activeContext'; import type { ClientUatCookieHandler } from './cookies/clientUat'; import { createClientUatCookie } from './cookies/clientUat'; import type { SessionCookieHandler } from './cookies/session'; @@ -75,7 +76,7 @@ export class AuthCookieService { this.clientUat = createClientUatCookie(cookieSuffix); this.sessionCookie = createSessionCookie(cookieSuffix); - this.activeCookie = createCookieHandler('clerk_active_context'); + this.activeCookie = createActiveContextCookie(); this.devBrowser = createDevBrowser({ frontendApi: clerk.frontendApi, fapiClient, @@ -84,10 +85,6 @@ export class AuthCookieService { } public async setup() { - // Cleanup old cookie - // TODO: This should be removed after 2025-08-01 - createCookieHandler('clerk_active_org').remove(); - if (this.instanceType === 'production') { return this.setupProduction(); } else { diff --git a/packages/clerk-js/src/core/auth/cookies/activeContext.ts b/packages/clerk-js/src/core/auth/cookies/activeContext.ts new file mode 100644 index 00000000000..36dea5b4339 --- /dev/null +++ b/packages/clerk-js/src/core/auth/cookies/activeContext.ts @@ -0,0 +1,20 @@ +import { createCookieHandler } from '@clerk/shared/cookie'; + +import { getSecureAttribute } from '../getSecureAttribute'; + +export const createActiveContextCookie = () => { + const handler = createCookieHandler('clerk_active_context'); + const attributes = { secure: getSecureAttribute('None') }; + + return { + set: (value: string) => { + handler.set(value, attributes); + }, + get: () => { + return handler.get(); + }, + remove: () => { + return handler.remove(attributes); + }, + }; +};