fix(backend): Fix issue with FAPI suffixed cookies disabled (#3789)

Co-authored-by: Nikos Douvlis <[email protected]> Co-authored-by: Stefanos Anagnostou <[email protected]>
clerk · Jul 24, 2024 · 04b15a2 · 04b15a2
1 parent 7bd6b67
commit 04b15a2
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/.changeset/eleven-suits-flow.md b/.changeset/eleven-suits-flow.md
@@ -0,0 +1,5 @@
+---
+"@clerk/backend": patch
+---
+
+Handle the scenario where FAPI returns unsuffixed cookies without throwing a handshake
diff --git a/packages/backend/src/tokens/authenticateContext.ts b/packages/backend/src/tokens/authenticateContext.ts
@@ -213,6 +213,14 @@ class AuthenticateContext {
       }
     }
 
+    // If a suffixed session cookie exists but the corresponding client_uat cookie is missing, fallback to using
+    // unsuffixed cookies.
+    // This handles the scenario where an app has been deployed using an SDK version that supports suffixed
+    // cookies, but FAPI for its Clerk instance has the feature disabled (eg: if we need to temporarily disable the feature).
+    if (!suffixedClientUat && suffixedSession) {
+      return false;
+    }
+
     return true;
   }