{"collection":{"slug":"auth-identity","name":"Auth & Identity"},"digest":{"id":"cwd_srTZwAHk2PlYXpwHSDiTA","weekStart":"2026-07-13","title":"Security hardening at the foundation","intro":"Clerk patched a stored XSS vector in SSR script tags, locked down IPC origin validation in Electron, and announced TLS cipher suite deprecation, while the Clerk JS SDK gained timeout-based failure recovery for slow Frontend API endpoints.","body":"### Stored XSS fix across the SDK stack\n\nThe most critical work this week spans multiple Clerk packages that share a common SSR pattern. Three releases — [Clerk JavaScript SDK](/release/rel_jhqhjKS9pRx6_L4kda9DL-clerk-javascript-sdk-patch-escapes-ssr-script-tags-to-prevent-stored-xss), [@clerk/tanstack-react-start](/release/rel_1aIV1eYBWbUDmHhdekQnC-clerk-tanstack-react-start-1-4-20-patches-stored-xss-via-session-claim-in-ssr), and [Clerk Astro](/release/rel_RnkuXrEyHdosoCdY7MTNO-clerk-astro-v3-4-19-fixes-stored-xss-via-serialized-session-claims) — all patch the same vulnerability: user-controllable session claims containing `</script>` could break out of the SSR `<script>` tag where Clerk serializes auth state, enabling stored XSS. The fix escapes `<`, `>`, and `/` during serialization while preserving identical JSON values on the client. If you're using any of these SDKs, the patch is a recommended upgrade.\n\n### Hardening IPC, session tokens, and TLS\n\nClerk's Electron SDK [v0.0.16](/release/rel_WachTvo3yRoOYNfgAQyks-clerk-electron-v0-0-16-validates-ipc-origin-to-prevent-token-theft-from) validates that token-cache and OAuth-transport IPC requests originate from a top-level window's main frame, preventing a subframe or `<webview>` that shares the Clerk preload from reading the persisted client JWT or driving the OAuth flow. Meanwhile, [@clerk/backend v3.11.7](/release/rel_sPLWntZmHusWVnIcxnVFB-clerk-backend-v3-11-7-rejects-machine-tokens-in-session-cookie) rejects machine tokens (M2M and OAuth JWTs) presented in the `__session` cookie — previously such a token could pass session verification and produce a signed-in state with a machine identity as `userId`, defeating `if (userId)` authorization checks. On the infrastructure side, Clerk [announced](/release/rel_srvTGeYmkCHq6i_vnk7yg-clerk-to-phase-out-cbc-cipher-suites-on-subdomains-by-january-2027) that CBC-mode TLS cipher suites will be removed from Clerk-managed subdomains in January 2027; clients that can only negotiate CBC will fail the handshake when certificates rotate.\n\n### Faster failure recovery and platform polish\n\nThe [Clerk JS SDK v6.25.3](/release/rel_-9PCDim4uk6M0pMV6izcm-clerk-js-sdk-6-25-3-fails-fast-on-slow-fapi-prevents-load-hang) and [@clerk/shared v4.25.3](/release/rel_q8DmuwFGHBO-t78QrwTA5-clerk-shared-v4-25-3-aborts-hung-fapi-requests-during-load-preventing-indefinite) introduce timeouts for Frontend API requests during load — if the FAPI is slow or unreachable, the client aborts the hung request and renders identity from a freshly minted session token in seconds instead of hanging while retries run. The same fix also prevents `useUser()` from retaining a cookie-derived stub user after full user data arrives. For Vercel customers, [@clerk/backend v3.11.6](/release/rel_-4bXJ3EtplXCWYU9dx0-c-clerk-javascript-sdk-clerk-backend-3-11-6-adds-auto-proxy-opt-out-for-vercel) and the [Next.js SDK](/release/rel_ED-X4dwBmOnismC5va2FL-clerk-next-js-sdk-v7-5-19-adds-opt-out-flag-for-automatic-frontend-api-proxying) add `CLERK_DISABLE_AUTO_PROXY=true` to opt out of automatic Frontend API proxying on production deployments.\n\nElsewhere, [Clerk Expo v3.7.7](/release/rel_G255ttTNorsUhsFCneXkD-clerk-expo-3-7-7-fixes-android-ui-component-crashes-and-duplicate-init-requests) fixes Android native UI component crashes after navigation detaches and reattaches, and [Clerk UI v1.25.5](/release/rel_0Yy7qikDK0uT_rhy_X8uV-clerk-ui-1-25-5-fixes-escape-key-behavior-in-drawer-and-improves-select) fixes Escape key behavior in the Drawer component. The [Clerk iOS SDK](/release/rel_y-NHUx6k_DN7Q3g7Wr1CX-clerk-ios-sdk-1-3-2-adds-cross-app-sync) adds cross-app sync support, and [Supabase Auth](/release/rel__PRgIv7qjAyLbGPlSR26s-supabase-auth-v2-193-0-links-provider-domains-and-downgrades-session-aal-on) introduces experimental provider linking-domain groups while downgrading session AAL after admin deletion of MFA factors. The [Auth0 dashboard](/release/rel_CAy09hV7po4YWXqHFa53G-auth0-dashboard-adds-role-search-in-public-beta) now supports real-time Role search by ID and name in public beta.","releaseIds":["rel_jhqhjKS9pRx6_L4kda9DL","rel_1aIV1eYBWbUDmHhdekQnC","rel_RnkuXrEyHdosoCdY7MTNO","rel_WachTvo3yRoOYNfgAQyks","rel_sPLWntZmHusWVnIcxnVFB","rel_srvTGeYmkCHq6i_vnk7yg","rel_-9PCDim4uk6M0pMV6izcm","rel_q8DmuwFGHBO-t78QrwTA5","rel_-4bXJ3EtplXCWYU9dx0-c","rel_ED-X4dwBmOnismC5va2FL","rel_G255ttTNorsUhsFCneXkD","rel_0Yy7qikDK0uT_rhy_X8uV","rel_y-NHUx6k_DN7Q3g7Wr1CX","rel__PRgIv7qjAyLbGPlSR26s","rel_CAy09hV7po4YWXqHFa53G"],"releaseCount":94,"generatedAt":"2026-07-20T06:17:57.607Z","releases":[{"id":"rel_jhqhjKS9pRx6_L4kda9DL","title":"Clerk JavaScript SDK patch escapes SSR script tags to prevent stored XSS","path":"/release/rel_jhqhjKS9pRx6_L4kda9DL-ssr-script-tags-escape-and-to-prevent-xss","org":{"slug":"clerk","name":"Clerk"},"importance":4},{"id":"rel_1aIV1eYBWbUDmHhdekQnC","title":"@clerk/tanstack-react-start@1.4.20 patches stored XSS via session claim in SSR script tag","path":"/release/rel_1aIV1eYBWbUDmHhdekQnC-stored-xss-via-session-claim-in-ssr-script-tag-fixed","org":{"slug":"clerk","name":"Clerk"},"importance":4},{"id":"rel_RnkuXrEyHdosoCdY7MTNO","title":"Clerk Astro v3.4.19 fixes stored XSS via serialized session claims","path":"/release/rel_RnkuXrEyHdosoCdY7MTNO-stored-xss-via-session-claims-fixed-initialization-hardened","org":{"slug":"clerk","name":"Clerk"},"importance":3},{"id":"rel_WachTvo3yRoOYNfgAQyks","title":"Clerk Electron v0.0.16 validates IPC origin to prevent token theft from subframes","path":"/release/rel_WachTvo3yRoOYNfgAQyks-ipc-requests-validated-against-subframe-token-theft","org":{"slug":"clerk","name":"Clerk"},"importance":4},{"id":"rel_sPLWntZmHusWVnIcxnVFB","title":"@clerk/backend v3.11.7 rejects machine tokens in __session cookie","path":"/release/rel_sPLWntZmHusWVnIcxnVFB-machine-tokens-in-session-cookie-now-rejected","org":{"slug":"clerk","name":"Clerk"},"importance":3},{"id":"rel_srvTGeYmkCHq6i_vnk7yg","title":"Clerk to phase out CBC cipher suites on subdomains by January 2027","path":"/release/rel_srvTGeYmkCHq6i_vnk7yg-cbc-cipher-suites-deprecated-on-clerk-managed-subdomains","org":{"slug":"clerk","name":"Clerk"},"importance":4},{"id":"rel_-9PCDim4uk6M0pMV6izcm","title":"Clerk JS SDK 6.25.3 fails fast on slow FAPI, prevents load hang","path":"/release/rel_-9PCDim4uk6M0pMV6izcm-slow-fapi-no-longer-hangs-clerk-load-on-startup","org":{"slug":"clerk","name":"Clerk"},"importance":3},{"id":"rel_q8DmuwFGHBO-t78QrwTA5","title":"@clerk/shared v4.25.3 aborts hung FAPI requests during load, preventing indefinite hangs","path":"/release/rel_q8DmuwFGHBO-t78QrwTA5-clerk-shared-v4-25-3-aborts-hung-fapi-requests-during-load-preventing-indefinite","org":{"slug":"clerk","name":"Clerk"},"importance":2},{"id":"rel_-4bXJ3EtplXCWYU9dx0-c","title":"Clerk JavaScript SDK @clerk/backend@3.11.6 adds auto-proxy opt-out for Vercel","path":"/release/rel_-4bXJ3EtplXCWYU9dx0-c-clerk-disable-auto-proxy-skips-vercel-frontend-api-proxying","org":{"slug":"clerk","name":"Clerk"},"importance":3},{"id":"rel_ED-X4dwBmOnismC5va2FL","title":"Clerk Next.js SDK v7.5.19 adds opt-out flag for automatic Frontend API proxying on Vercel","path":"/release/rel_ED-X4dwBmOnismC5va2FL-auto-frontend-api-proxying-on-vercel-now-opt-out-via-env-flag","org":{"slug":"clerk","name":"Clerk"},"importance":2},{"id":"rel_G255ttTNorsUhsFCneXkD","title":"@clerk/expo@3.7.7 fixes Android UI component crashes and duplicate init requests","path":"/release/rel_G255ttTNorsUhsFCneXkD-android-ui-components-survive-navigation-duplicate-inits-prevented","org":{"slug":"clerk","name":"Clerk"},"importance":2},{"id":"rel_0Yy7qikDK0uT_rhy_X8uV","title":"@clerk/ui 1.25.5 fixes Escape key behavior in Drawer and improves Select accessibility","path":"/release/rel_0Yy7qikDK0uT_rhy_X8uV-escape-key-in-drawer-select-no-longer-dismisses-entire-drawer-select","org":{"slug":"clerk","name":"Clerk"},"importance":2},{"id":"rel_y-NHUx6k_DN7Q3g7Wr1CX","title":"Clerk iOS SDK 1.3.2 adds cross-app sync","path":"/release/rel_y-NHUx6k_DN7Q3g7Wr1CX-cross-app-sync-added","org":{"slug":"clerk","name":"Clerk"},"importance":2},{"id":"rel__PRgIv7qjAyLbGPlSR26s","title":"Supabase Auth v2.193.0 links provider domains and downgrades session AAL on factor deletion","path":"/release/rel__PRgIv7qjAyLbGPlSR26s-provider-linking-domain-groups-session-aal-downgraded-after-factor-deletion","org":{"slug":"supabase","name":"Supabase"},"importance":2},{"id":"rel_CAy09hV7po4YWXqHFa53G","title":"Auth0 dashboard adds Role search in public beta","path":"/release/rel_CAy09hV7po4YWXqHFa53G-dashboard-now-searches-roles-by-id-and-name-in-real-time","org":{"slug":"auth0","name":"Auth0"},"importance":3}]}}