releases.shpreview

Auth & Identity

Drop-in authentication, user management, and identity infrastructure for modern apps.

This week: Security hardening at the foundation →
FriJul 17, 20262 releases
Clerk
Daily summary

Clerk Electron blocks subframe token theft

Clerk's Electron SDK now validates IPC origin to prevent JWT theft from subframes, while the Expo SDK reduces redundant client refreshes during startup.

  • Clerk Electron validates token-cache and OAuth-transport IPC requests to block untrusted subframes or webviews from reading client JWTs or driving OAuth flows
  • Clerk Expo reduces redundant native and JavaScript client refreshes during startup, trimming unnecessary overhead
ClerkClerk2
ThuJul 16, 202618 releases
Clerk
Daily summary

Clerk patches stored XSS in SSR script tags and rejects machine tokens in session cookies

Clerk shipped a security patch across its SDK ecosystem, escaping angle brackets in serialized auth state to prevent stored XSS via SSR script tags, while also rejecting machine tokens presented in the __session cookie to prevent authorization bypass.

  • Clerk now escapes <code>&lt;</code>, <code>&gt;</code>, and <code>/</code> when serializing auth state into SSR <code>&lt;script&gt;</code> tags, closing a stored XSS vector where <code>&lt;/script&gt;</code> in user-controllable session claims could break out of the script element
  • Clerk's backend rejects machine tokens (M2M and OAuth JWTs) in the <code>__session</code> cookie, returning a signed-out state instead of passing verification with a machine identity as <code>userId</code>
  • Clerk Expo fixed Android native UI components crashing before window attachment and prevented duplicate initialization requests
  • Clerk UI improved Escape key handling in nested Drawer/Select combos and enhanced Select keyboard and screen reader support
ClerkClerk18