fix(js): keep a Device Intelligence result that arrives after the deadline by mwickett · Pull Request #10276 · clerk/javascript

mwickett · 2026-10-16T12:39:45Z

Description

ClerkJS waits a limited time for the Device Intelligence result (the Protect session token) before it sends a sign-in or sign-up. A result that arrived after that deadline was discarded. A failed attempt also isn't retried for 30 seconds, so a user who clicked again inside that window sent the request without a result again, even though the token was already in the page.

This PR keeps a result that arrives after the deadline and writes it to the shared token store, where the next sign-in or sign-up picks it up. If another tab holds the lock past its five-second wait, the save retries in the background while the token remains usable. It covers both ways a result can be late:

the loader script finishes loading after the deadline;
the script loads in time, but its ready promise settles after the deadline. The late read has no second deadline, so the result is kept however late it arrives.

What stays the same:

The request that timed out still reports timeout, and no request waits any longer than before.
A late token goes through the same checks as an on-time one: minted for this page's correlation id, well-formed, unexpired, under the size limit.
The server still decides whether a token is valid; when it reached the browser isn't part of that check.
A late token is saved under the same cross-tab lock as an on-time one. A failed lock attempt retries after one second without extending authentication waits. The token is checked again after acquiring the lock and is discarded once it has five seconds or less remaining. It doesn't replace a stored token that is at least as good: one stamped with a newer invalidation cutoff, or one that expires later.
Instances using the optional token_url mint are unchanged.

When a late token is stored, the failure backoff resets, since the attempt did produce a token.

This is independent of #10275, which raises the default wait to 10 seconds; each helps on its own.

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

vercel · 2026-10-16T12:39:49Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Oct 23, 2026 2:29pm UTC
swingset	Ready	Preview	Oct 23, 2026 2:29pm UTC

changeset-bot · 2026-10-16T12:39:53Z

🦋 Changeset detected

Latest commit: 93dc1f4

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/electron	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-10-16T12:39:56Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Source mode: Auto
Repository: clerk/javascript
Branch: mwickett/protect-keep-late-di-token
File: .coderabbit.yaml
Commit: 93dc1f4
Layers: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Team
Run ID: e143c8d9-75ed-4b6d-9926-6d45a230b91d

📥 Commits

Reviewing files that changed from the base of the PR and between 42664a9 and 93dc1f4.

📒 Files selected for processing: 3

.changeset/protect-keep-late-di-token.md
packages/clerk-js/src/core/__tests__/protectSession.test.ts
packages/clerk-js/src/core/protectSession.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go (manual)
clerk/dashboard (manual)
clerk/accounts (manual)
clerk/backoffice (manual)
clerk/clerk (manual)
clerk/clerk-docs (manual)
clerk/cloudflare-workers (manual)
clerk/clerk-android (auto-detected)
clerk/cli (auto-detected)
clerk/clerk-ios (auto-detected)

Included review availability: This review used your included allowance. 6 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

📝 Walkthrough

ProtectSession now reads Device Intelligence results that arrive after the original request deadline. It can store a late token under the cross-tab lock when the token remains usable and meets the replacement rules. The tests cover late loader results, token replacement, lock retries, and results that do not qualify for storage.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: zourzouvillys

Merge Risk: ⚪ Minimal · up to 93dc1

Late Device Intelligence tokens can be retained for a later request without extending the timed-out request. No actionable merge-blocking risk was found.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: retaining a Device Intelligence result that arrives after the deadline.
Description check		The description directly explains the late-token behavior, lock handling, validation rules, retry behavior, and unchanged behavior. It is clearly related to the changeset.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 unsupported.)

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.

_{Comment @coderabbitai help to get the list of available commands.}

pkg-pr-new · 2026-10-16T12:42:50Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@10276

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@10276

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@10276

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@10276

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@10276

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@10276

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@10276

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@10276

@clerk/expo-biometrics

npm i https://pkg.pr.new/@clerk/expo-biometrics@10276

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@10276

@clerk/expo-native-components

npm i https://pkg.pr.new/@clerk/expo-native-components@10276

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@10276

@clerk/express

npm i https://pkg.pr.new/@clerk/express@10276

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@10276

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@10276

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@10276

@clerk/mosaic

npm i https://pkg.pr.new/@clerk/mosaic@10276

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@10276

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@10276

@clerk/react

npm i https://pkg.pr.new/@clerk/react@10276

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@10276

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@10276

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@10276

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@10276

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@10276

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@10276

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@10276

commit: 93dc1f4

…dline

…ep the better token

chatgpt-codex-connector · 2026-10-23T15:20:21Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T15:22:51.731170Z	`93dc1f4`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 93dc1f492a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-23T15:22:49Z

    return 'ok';
  }

+  /** A token that lands after the deadline was still minted for this page, so keep it for the next sign-in. */


Remove the newly added code comments

The repository explicitly forbids adding code comments unless the user requests them; this new JSDoc and the other newly added inline comments around late reads and saves therefore violate the package-wide contribution rule and should be removed.

AGENTS.md reference: AGENTS.md:L9-L9

Useful? React with 👍 / 👎.

github-actions · 2026-10-23T15:24:39Z

API Changes Report

Generated by Break Check on 2026-10-23T15:24:35.974Z

Summary

Metric	Count
Packages analyzed	20
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

Report generated by Break Check

_{Last ran on 93dc1f4.}

github-actions Bot added the clerk-js label Oct 16, 2026

vercel Bot deployed to Preview – clerk-js-sandbox October 16, 2026 12:40

View deployment

vercel Bot deployed to Preview – swingset October 16, 2026 12:42

View deployment

vercel Bot deployed to Preview – clerk-js-sandbox October 16, 2026 13:23

View deployment

vercel Bot deployed to Preview – swingset October 16, 2026 13:25

View deployment

mwickett added 3 commits October 23, 2026 10:19

fix(js): keep a Device Intelligence result that arrives after the dea…

e128c2a

…dline

fix(js): store a late Device Intelligence token under the lock and ke…

9c453ac

…ep the better token

fix(js): retry late Device Intelligence saves after lock timeouts

93dc1f4

mwickett force-pushed the mwickett/protect-keep-late-di-token branch from b5f04ea to 93dc1f4 Compare October 23, 2026 14:26

vercel Bot deployed to Preview – clerk-js-sandbox October 23, 2026 14:27

View deployment

vercel Bot deployed to Preview – swingset October 23, 2026 14:29

View deployment

mwickett mentioned this pull request Oct 23, 2026

fix(js): wait up to 10s for the Device Intelligence result by default #10275

Open

4 of 9 tasks

mwickett marked this pull request as ready for review October 23, 2026 15:20

chatgpt-codex-connector Bot reviewed Oct 23, 2026

View reviewed changes

zourzouvillys approved these changes Oct 23, 2026

View reviewed changes

Navigation Menu

Repository navigation

fix(js): keep a Device Intelligence result that arrives after the deadline - #10276

fix(js): keep a Device Intelligence result that arrives after the deadline#10276
mwickett wants to merge 3 commits into
mainfrom
mwickett/protect-keep-late-di-token

mwickett commented Oct 16, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mwickett commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Type of change

Uh oh!

vercel Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 23, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Oct 23, 2026

API Changes Report

Summary

No API Changes Detected

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mwickett commented Oct 16, 2026 •

edited

Loading

vercel Bot commented Oct 16, 2026 •

edited

Loading

changeset-bot Bot commented Oct 16, 2026 •

edited

Loading

coderabbitai Bot commented Oct 16, 2026 •

edited

Loading

pkg-pr-new Bot commented Oct 16, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading