fix(clerk-js): Prevent session cookie removal during offline token refresh by bratsos · Pull Request #7912 · clerk/javascript

bratsos · 2026-02-23T19:58:12Z

Description

When offline, two code paths in Session.ts emit token:update events with empty tokens. AuthCookieService interprets empty tokens as signed-out and removes the __session cookie — even though the session is still valid server-side. On the next page load or visibility change, the missing cookie makes the user appear signed out.

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Summary by CodeRabbit

Bug Fixes
- Prevented unexpected sign-outs by avoiding caching or dispatching empty tokens when offline, preserving stale tokens and adding offline-aware retry/error signaling.
Tests
- Added and updated tests for offline retries, background refresh timing, deduplication, and recovery-from-offline to ensure no incorrect token events.
Chores
- Added a changeset entry for the patch.

changeset-bot · 2026-02-23T19:58:16Z

🦋 Changeset detected

Latest commit: 2c09e1e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2026-02-23T19:58:17Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Mar 2, 2026 4:10pm

pkg-pr-new · 2026-02-23T20:01:36Z

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@7912

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@7912

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@7912

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@7912

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@7912

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@7912

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@7912

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@7912

@clerk/express

npm i https://pkg.pr.new/@clerk/express@7912

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@7912

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@7912

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@7912

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@7912

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@7912

@clerk/react

npm i https://pkg.pr.new/@clerk/react@7912

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@7912

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@7912

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@7912

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@7912

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@7912

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@7912

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@7912

commit: 2c09e1e

jacekradko · 2026-02-23T20:31:12Z

packages/clerk-js/src/core/resources/__tests__/Session.test.ts


    describe('with offline browser and network failure', () => {
      beforeEach(() => {
-        // Use real timers for offline tests to avoid unhandled rejection issues with retry logic


coderabbitai · 2026-02-25T12:20:10Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds a changeset entry for a patch release. Updates packages/clerk-js/src/core/resources/Session.ts to import ClerkRuntimeError and add offline-aware logic: _getToken, _fetchToken, _dispatchTokenEvents, and background refresh now avoid caching or dispatching empty tokens and surface offline as explicit errors to trigger retry behavior. Updates packages/clerk-js/src/core/resources/__tests__/Session.test.ts to adjust timer usage, rename and rework offline-retry tests, and add tests covering offline failures, background-refresh edge cases, recovery mid-request, and timer-driven refresh behavior. No public API signatures changed.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main bug fix: preventing session cookie removal during offline token refresh operations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

packages/clerk-js/src/core/resources/Session.ts

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/clerk-js/src/core/resources/Session.ts`:
- Around line 451-453: The token-update path currently emits and caches/clears
when isValidBrowserOnline() is true even if cachedToken.getRawString() is empty;
change the guard so eventBus.emit(events.TokenUpdate, { token: cachedToken })
and any code that writes/clears __session only run when
cachedToken.getRawString() is truthy (i.e., require a non-empty token), and do
not rely on isValidBrowserOnline() as a substitute for a missing token. Apply
this same change to the other TokenUpdate/caching occurrences that use
cachedToken.getRawString() || isValidBrowserOnline() so all places (the
eventBus.emit call and the __session write/clear logic) first check
cachedToken.getRawString() before proceeding.

ℹ️ Review info

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

Linear integration is disabled

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 2377201 and fd118d9.

📒 Files selected for processing (2)

packages/clerk-js/src/core/resources/Session.ts
packages/clerk-js/src/core/resources/__tests__/Session.test.ts

packages/clerk-js/src/core/resources/Session.ts

…fresh

…oken refresh

brkalow · 2026-03-02T17:16:44Z

packages/shared/src/browser.ts

+  // navigator.onLine is the standard API and is reliable for detecting
+  // complete disconnection (airplane mode, WiFi off, etc.).
+  // The experimental navigator.connection API (rtt/downlink) was previously
+  // used as a secondary signal, but it reports zero values in headless browsers
+  // and CI environments even when connected, causing false offline detection.
+  return !!navigator.onLine;


hmm, I'm not sure we want to change this. can we look back in the history? I feel like I recall there being issues with only relying on navigator.onLine in the past

I couldn't find something concrete - the main difference is that navigator.onLine can return true even when there's no actual internet connectivity (it only detects whether the device is connected to a network, for example a wifi network with no internet access).

navigator.connection seems like a better signal but it's more unreliable as it's not supported on Firefox or Safari at all, in headless browsers it reports navigator.connection.rtt == 0 and I found other issues around the web as well.

This seems the better fix and we can always iterate. WDYT?

github-actions bot added clerk-js core-3 labels Feb 23, 2026

jacekradko reviewed Feb 23, 2026

View reviewed changes

bratsos force-pushed the alexbratsos/user-4744-investigate-random-sign-outs-in-the-dashboard-possibly branch from d134aeb to c230146 Compare February 25, 2026 12:05

vercel bot deployed to Preview February 25, 2026 12:06 View deployment

vercel bot deployed to Preview February 25, 2026 17:14 View deployment

bratsos force-pushed the alexbratsos/user-4744-investigate-random-sign-outs-in-the-dashboard-possibly branch from 992a3ba to 2377201 Compare February 25, 2026 18:04

vercel bot deployed to Preview February 25, 2026 18:04 View deployment

brkalow reviewed Feb 27, 2026

View reviewed changes

packages/clerk-js/src/core/resources/Session.ts Show resolved Hide resolved

brkalow reviewed Feb 27, 2026

View reviewed changes

packages/clerk-js/src/core/resources/Session.ts Show resolved Hide resolved

vercel bot deployed to Preview February 27, 2026 19:09 View deployment

bratsos requested a review from brkalow February 27, 2026 19:11

coderabbitai bot reviewed Feb 27, 2026

View reviewed changes

packages/clerk-js/src/core/resources/Session.ts Outdated Show resolved Hide resolved

vercel bot deployed to Preview March 2, 2026 14:27 View deployment

vercel bot deployed to Preview March 2, 2026 15:19 View deployment

vercel bot deployed to Preview March 2, 2026 15:59 View deployment

bratsos added 5 commits March 2, 2026 17:09

fix(clerk-js): Prevent session cookie removal during offline token re…

618871a

…fresh

fixup! fix(clerk-js): Prevent session cookie removal during offline t…

be6256a

…oken refresh

fixup! fix(clerk-js): Prevent session cookie removal during offline t…

4c86bb9

…oken refresh

fixup! fix(clerk-js): Prevent session cookie removal during offline t…

2c9a84e

…oken refresh

fixup! fix(clerk-js): Prevent session cookie removal during offline t…

2c09e1e

…oken refresh

bratsos force-pushed the alexbratsos/user-4744-investigate-random-sign-outs-in-the-dashboard-possibly branch from 745dbbe to 2c09e1e Compare March 2, 2026 16:09

vercel bot deployed to Preview March 2, 2026 16:10 View deployment

brkalow reviewed Mar 2, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(clerk-js): Prevent session cookie removal during offline token refresh#7912

fix(clerk-js): Prevent session cookie removal during offline token refresh#7912
bratsos wants to merge 5 commits intomainfrom
alexbratsos/user-4744-investigate-random-sign-outs-in-the-dashboard-possibly

bratsos commented Feb 23, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

changeset-bot bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

vercel bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

pkg-pr-new bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

jacekradko Feb 23, 2026

Uh oh!

coderabbitai bot commented Feb 25, 2026 •

edited

Loading

Reviews paused

Walkthrough

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

brkalow Mar 2, 2026

Uh oh!

bratsos Mar 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

bratsos commented Feb 23, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Type of change

Summary by CodeRabbit

Uh oh!

changeset-bot bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

vercel bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pkg-pr-new bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jacekradko Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot commented Feb 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Uh oh!

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

brkalow Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

bratsos Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

bratsos commented Feb 23, 2026 •

edited by coderabbitai bot

Loading

changeset-bot bot commented Feb 23, 2026 •

edited

Loading

vercel bot commented Feb 23, 2026 •

edited

Loading

pkg-pr-new bot commented Feb 23, 2026 •

edited

Loading

coderabbitai bot commented Feb 25, 2026 •

edited

Loading