fix(backend): Do not throw on malformed host values

[brkalow]

Description

fixes #7275

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

Summary by CodeRabbit

Bug Fixes

• Fixed host header parsing to gracefully handle malformed and empty forwarded headers without throwing exceptions, enhancing application stability and reliability.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[changeset-bot]

🦋 Changeset detected

Latest commit: d5026ae

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@clerk/backend	Patch
@clerk/agent-toolkit	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/remix	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
clerk-js-sandbox	Ready	Preview	Comment	Dec 4, 2025 5:14pm

[coderabbitai]

Walkthrough

This change adds error handling to the host header parsing logic in deriveUrlFromHeaders. When URL construction fails due to malformed headers, the function now catches the exception and falls back to the original URL instead of crashing. Three new tests validate graceful handling of malicious and empty forwarded headers.

Changes

Cohort / File(s)	Summary
Changeset entry .changeset/gentle-clouds-heal.md	Patch release for @clerk/backend documenting a fix: host header parsing no longer throws exceptions on malformed input.
Host header error handling packages/backend/src/tokens/clerkRequest.ts	Wraps URL construction in try-catch within deriveUrlFromHeaders, falling back to the original URL if createClerkUrl throws an error.
Host header validation tests packages/backend/src/tokens/__tests__/clerkRequest.test.ts	Adds three new test cases covering: malicious host headers with script injection, invalid characters, and empty forwarded headers—verifying all are handled without throwing.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Localized defensive programming pattern (try-catch fallback) in a single function
• Tests are straightforward and directly validate the fix
• No complex logic interactions or widespread refactoring
• Clear mapping between test cases and code behavior

Poem

🐰 A malicious header tried to break us, no way!
With a try-catch embrace, we gracefully sway,
Phishers may frown, but Clerk stays online,
Dodging those crashes—security so fine! 🛡️

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'fix(backend): Do not throw on malformed host values' directly aligns with the main change: adding a try/catch fallback in deriveUrlFromHeaders to prevent crashes from malformed host headers.
Linked Issues check	✅ Passed	The PR successfully addresses issue #7275 by implementing a try/catch wrapper in deriveUrlFromHeaders that prevents URL constructor exceptions when encountering malicious/malformed host values, and includes comprehensive test coverage validating this behavior.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing the deriveUrlFromHeaders vulnerability: functional changes to add error handling, test cases to validate the fix, and a changeset entry documenting the patch.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch brk.fix/gh-7275

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 8376789 and d5026ae.

📒 Files selected for processing (3)

• .changeset/gentle-clouds-heal.md (1 hunks)
• packages/backend/src/tokens/__tests__/clerkRequest.test.ts (1 hunks)
• packages/backend/src/tokens/clerkRequest.ts (1 hunks)

🧰 Additional context used

📓 Path-based instructions (9)

**/*.{js,jsx,ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/development.mdc)

All code must pass ESLint checks with the project's configuration

Files:

• packages/backend/src/tokens/__tests__/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

**/*.{js,jsx,ts,tsx,json,md,yml,yaml}

📄 CodeRabbit inference engine (.cursor/rules/development.mdc)

Use Prettier for consistent code formatting

Files:

• packages/backend/src/tokens/__tests__/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

packages/**/src/**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/development.mdc)

TypeScript is required for all packages

Files:

• packages/backend/src/tokens/__tests__/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (.cursor/rules/development.mdc)

Follow established naming conventions (PascalCase for components, camelCase for variables)

Prefer importing types from @clerk/shared/types instead of the deprecated @clerk/types alias

Files:

• packages/backend/src/tokens/__tests__/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

packages/**/src/**/*.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (.cursor/rules/development.mdc)

packages/**/src/**/*.{ts,tsx,js,jsx}: Maintain comprehensive JSDoc comments for public APIs
Use tree-shaking friendly exports
Validate all inputs and sanitize outputs
All public APIs must be documented with JSDoc
Use dynamic imports for optional features
Provide meaningful error messages to developers
Include error recovery suggestions where applicable
Log errors appropriately for debugging
Lazy load components and features when possible
Implement proper caching strategies
Use efficient data structures and algorithms
Implement proper logging with different levels

Files:

• packages/backend/src/tokens/__tests__/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

**/*.{test,spec}.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (.cursor/rules/development.mdc)

**/*.{test,spec}.{ts,tsx,js,jsx}: Unit tests are required for all new functionality
Verify proper error handling and edge cases
Include tests for all new features

Files:

• packages/backend/src/tokens/__tests__/clerkRequest.test.ts

**/*.ts?(x)

📄 CodeRabbit inference engine (.cursor/rules/development.mdc)

Use proper TypeScript error types

Files:

• packages/backend/src/tokens/__tests__/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

**/*.{test,spec,e2e}.{ts,tsx,js,jsx}

📄 CodeRabbit inference engine (.cursor/rules/development.mdc)

Use real Clerk instances for integration tests

Files:

• packages/backend/src/tokens/__tests__/clerkRequest.test.ts

**/*.{ts,tsx}

📄 CodeRabbit inference engine (.cursor/rules/typescript.mdc)

**/*.{ts,tsx}: Always define explicit return types for functions, especially public APIs
Use proper type annotations for variables and parameters where inference isn't clear
Avoid any type - prefer unknown when type is uncertain, then narrow with type guards
Implement type guards for unknown types using the pattern function isType(value: unknown): value is Type
Use interface for object shapes that might be extended
Use type for unions, primitives, and computed types
Prefer readonly properties for immutable data structures
Use private for internal implementation details in classes
Use protected for inheritance hierarchies
Use public explicitly for clarity in public APIs
Use mixins for shared behavior across unrelated classes in TypeScript
Use generic constraints with bounded type parameters like <T extends { id: string }>
Use utility types like Omit, Partial, and Pick for data transformation instead of manual type construction
Use discriminated unions instead of boolean flags for state management and API responses
Use mapped types for transforming object types
Use conditional types for type-level logic
Leverage template literal types for string manipulation at the type level
Use ES6 imports/exports consistently
Use default exports sparingly, prefer named exports
Document functions with JSDoc comments including @param, @returns, @throws, and @example tags
Create custom error classes that extend Error for specific error types
Use the Result pattern for error handling instead of throwing exceptions
Use optional chaining (?.) and nullish coalescing (??) operators for safe property access
Let TypeScript infer obvious types to reduce verbosity
Use const assertions with as const for literal types
Use satisfies operator for type checking without widening types
Declare readonly arrays and objects for immutable data structures
Use spread operator and array spread for immutable updates instead of mutations
Use lazy loading for large types...

Files:

• packages/backend/src/tokens/__tests__/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

🧬 Code graph analysis (1)

packages/backend/src/tokens/__tests__/clerkRequest.test.ts (1)

packages/backend/src/tokens/clerkRequest.ts (1)

• createClerkRequest (84-86)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)

• GitHub Check: Build Packages
• GitHub Check: Formatting | Dedupe | Changeset
• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: semgrep-cloud-platform/scan
• GitHub Check: Analyze (javascript-typescript)

🔇 Additional comments (3)

packages/backend/src/tokens/clerkRequest.ts (1)

63-67: Guarded URL construction and fallback behavior look correct

Wrapping the forwarded-origin path construction in a try/catch and falling back to createClerkUrl(initialUrl) cleanly prevents crashes on malformed host values while preserving the existing behavior for valid headers. No further changes needed here.

packages/backend/src/tokens/__tests__/clerkRequest.test.ts (1)

162-193: New tests robustly cover hostile and empty forwarded header cases

These three tests nicely pin the intended behavior: createClerkRequest no longer throws on malicious or empty forwarded headers and correctly falls back to the original URL. The expectations align with the updated deriveUrlFromHeaders logic.

.changeset/gentle-clouds-heal.md (1)

1-5: Changeset accurately documents the host header parsing fix

The patch entry correctly describes the behavior change (no longer throwing on malformed host values) and is aligned with the code and tests in this PR.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pkg-pr-new]

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7370

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7370

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7370

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7370

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7370

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7370

@clerk/elements

npm i https://pkg.pr.new/@clerk/elements@7370

@clerk/clerk-expo

npm i https://pkg.pr.new/@clerk/clerk-expo@7370

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7370

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7370

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7370

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7370

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7370

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7370

@clerk/clerk-react

npm i https://pkg.pr.new/@clerk/clerk-react@7370

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7370

@clerk/remix

npm i https://pkg.pr.new/@clerk/remix@7370

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7370

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7370

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7370

@clerk/themes

npm i https://pkg.pr.new/@clerk/themes@7370

@clerk/types

npm i https://pkg.pr.new/@clerk/types@7370

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7370

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7370

commit: d5026ae

[jacekradko]

👍🏼