chore(repo): Wip

clerk · Jul 23, 2024 · 7b17760 · 7b17760
1 parent 084882b
commit 7b17760
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/packages/backend/src/tokens/authenticateContext.ts b/packages/backend/src/tokens/authenticateContext.ts
@@ -213,10 +213,10 @@ class AuthenticateContext {
       }
     }
 
-    // In case of incorrectly setup suffixed cookies (session exists but client_uat missing)
-    // let's use the un-suffixed cookies to keep the existing behavior.
-    // This case can be reproduced for production instances when new ClerkJS and backend SDK
-    // are used but the FF in FAPI is disabled
+    // If a suffixed session cookie exists but the corresponding client_uat cookie is missing, fallback to using
+    // unsuffixed cookies.
+    // This handle the scenario where an app has been deployed using an SDK version that supports suffixed
+    // cookies, but FAPI for its Clerk instance has the feature disabled (eg: if we need to temporarily disable the feature).
     if (!suffixedClientUat && suffixedSession) {
       return false;
     }

diff --git a/packages/backend/src/tokens/request.ts b/packages/backend/src/tokens/request.ts
@@ -90,7 +90,7 @@ export async function authenticateRequest(
 
     const url = new URL(`https://${frontendApiNoProtocol}/v1/client/handshake`);
     url.searchParams.append('redirect_url', redirectUrl?.href || '');
-    url.searchParams.append('suffixed_cookies', 'true');
+    url.searchParams.append('suffixed_cookies', authenticateContext.suffixedCookies.toString());
 
     if (authenticateContext.instanceType === 'development' && authenticateContext.devBrowserToken) {
       url.searchParams.append(constants.QueryParameters.DevBrowser, authenticateContext.devBrowserToken);