feat(expo): add hosted auth flow#8960
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: 63f5baa The changes in this PR will be included in the next version bump. This PR includes changesets to release 23 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds hosted auth support for native Expo apps, with new hook and utility APIs, shared PKCE/codeVerifier plumbing, public re-exports, and tests. ChangesHosted Auth Flow for Expo
Sequence Diagram(s)sequenceDiagram
participant useHostedAuth
participant createHostedAuth
participant expoWebBrowser
participant Client
participant clerk
useHostedAuth->>createHostedAuth: create hosted-auth URL
createHostedAuth->>clerk: POST /client/hosted_auth
createHostedAuth-->>useHostedAuth: hosted-auth URL
useHostedAuth->>expoWebBrowser: openAuthSessionAsync(hosted-auth URL, redirectUrl)
expoWebBrowser-->>useHostedAuth: callback URL
useHostedAuth->>Client: reload({ rotatingTokenNonce, codeVerifier })
Client-->>useHostedAuth: updated client
useHostedAuth->>clerk: setActive(created_session_id)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
Comment |
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/electron
@clerk/electron-passkeys
@clerk/eslint-plugin
@clerk/expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
API Changes Report
Summary
@clerk/expoCurrent version: 3.5.4 Subpath
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/clerk-js/src/core/resources/Base.ts (1)
204-210: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftDon't send the PKCE verifier through
_baseGet.Line 209 forwards
codeVerifieron a hard-codedGET, andpackages/clerk-js/src/core/fapiClient.tsserializes that field into the URL ascode_verifier. That puts the PKCE secret in request URLs, which are routinely captured by logs, proxies, and request instrumentation. This redemption should go through a body-bearing request instead of the_baseGetpath.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/clerk-js/src/core/resources/Base.ts` around lines 204 - 210, The _baseGet method in BaseResource is forwarding codeVerifier into a hard-coded GET request, which causes fapiClient serialization to place the PKCE secret in the URL. Update BaseResource._baseGet so it no longer passes codeVerifier through the GET path; instead, route this redemption through a body-bearing request flow or another non-URL transport, and keep the existing path/rotatingTokenNonce behavior intact.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/expo/src/hooks/useHostedAuth.ts`:
- Around line 10-30: Add customer-facing JSDoc for the new public hosted-auth
exports so generated docs are populated and reviewable. Document HostedAuthMode,
StartHostedAuthParams, and StartHostedAuthReturnType with concise descriptions
of their purpose and fields, and add JSDoc on useHostedAuth explaining what the
hook provides. Also give useHostedAuth an explicit return type instead of
relying on inference, matching the repo’s public API guidelines and keeping the
exported surface in line with other SDK APIs.
- Around line 12-23: The public types in useHostedAuth are leaking optional Expo
browser dependencies into the `@clerk/expo` API surface. Update
StartHostedAuthParams and StartHostedAuthReturnType so they no longer reference
WebBrowser.AuthSessionOpenOptions, WebBrowser.WebBrowserAuthSessionResult, or
ClientResource directly in the exported declarations; instead, hide those behind
local/internal interfaces or move the hosted-auth-specific types into a separate
entrypoint. Ensure the exposed .d.ts for useHostedAuth only contains
dependency-agnostic types so consumers who do not install expo-auth-session or
expo-web-browser are not forced to resolve them.
- Around line 189-205: The callback URL validation in
callbackUrlMatchesRedirectUrl currently skips authority checking when the
redirect URL has an empty host, which allows unexpected authorities like
attacker-controlled hosts to pass for triple-slashed deep links. Update the
matching logic in useHostedAuth.ts to compare the callbackUrl host/authority and
pathname exactly against the parsed redirectUrl for hosted-auth callbacks,
instead of treating an empty expected host as a wildcard. Add a regression test
covering a redirectUrl such as myapp:///hosted-auth-callback and a mismatched
callbackUrl like myapp://attacker/hosted-auth-callback to ensure the authority
is rejected.
---
Outside diff comments:
In `@packages/clerk-js/src/core/resources/Base.ts`:
- Around line 204-210: The _baseGet method in BaseResource is forwarding
codeVerifier into a hard-coded GET request, which causes fapiClient
serialization to place the PKCE secret in the URL. Update BaseResource._baseGet
so it no longer passes codeVerifier through the GET path; instead, route this
redemption through a body-bearing request flow or another non-URL transport, and
keep the existing path/rotatingTokenNonce behavior intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 9713ccce-5bc5-4f09-bb0b-c9275074bbd5
📒 Files selected for processing (10)
.changeset/hosted-auth-expo.mdpackages/clerk-js/src/core/__tests__/fapiClient.test.tspackages/clerk-js/src/core/fapiClient.tspackages/clerk-js/src/core/resources/Base.tspackages/expo/src/hooks/__tests__/useHostedAuth.test.tspackages/expo/src/hooks/index.tspackages/expo/src/hooks/useHostedAuth.tspackages/expo/src/types/index.tspackages/expo/src/utils/hostedAuth.tspackages/shared/src/types/resource.ts
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4d734f0d8b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5dfea68732
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
packages/clerk-js/src/core/resources/Client.ts (1)
81-100: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winClarify docs for the new
reloadhosted-auth path.This changes a public method’s behavior when
rotatingTokenNonceandcodeVerifierare paired, but there’s still no method-level JSDoc explaining when callers should use that path or that the verifier is redeemed from the request body. IfClient.reloadis reference-facing, please document it and loop in Docs. As per path instructions, "If a PR adds or changes public/reference-facing API surface area, check whether the corresponding JSDoc is present, accurate, and aligned with the implementation."🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/clerk-js/src/core/resources/Client.ts` around lines 81 - 100, `Client.reload` now has a hosted-auth branch when `rotatingTokenNonce` and `codeVerifier` are present, but the public API lacks JSDoc describing when to use it and that the verifier is sent in the request body. Add method-level documentation on `Client.reload` explaining the two reload paths, the required pairing of `rotatingTokenNonce` with `codeVerifier`, and that this path redeems the verifier via the POST body; keep the docs aligned with the implementation and note that Docs should be looped in for this reference-facing change.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/clerk-js/src/core/__tests__/fapiClient.test.ts`:
- Line 154: The test in fapiClient should cover both rotating token nonce
behavior and the security edge case that codeVerifier is never included in the
generated URL. Update the existing `adds rotating token nonce when provided`
test around `buildUrl()` to assert the nonce is present while also verifying
`code_verifier` is not emitted, using the same `FapiClient` URL-building path so
the regression is caught if PKCE data ever leaks.
---
Nitpick comments:
In `@packages/clerk-js/src/core/resources/Client.ts`:
- Around line 81-100: `Client.reload` now has a hosted-auth branch when
`rotatingTokenNonce` and `codeVerifier` are present, but the public API lacks
JSDoc describing when to use it and that the verifier is sent in the request
body. Add method-level documentation on `Client.reload` explaining the two
reload paths, the required pairing of `rotatingTokenNonce` with `codeVerifier`,
and that this path redeems the verifier via the POST body; keep the docs aligned
with the implementation and note that Docs should be looped in for this
reference-facing change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: 745841d4-8924-4910-bab0-04c9e597e775
📒 Files selected for processing (6)
packages/clerk-js/src/core/__tests__/fapiClient.test.tspackages/clerk-js/src/core/resources/Client.tspackages/clerk-js/src/core/resources/__tests__/Client.test.tspackages/expo/src/hooks/__tests__/useHostedAuth.test.tspackages/expo/src/hooks/useHostedAuth.tspackages/expo/src/utils/hostedAuth.ts
🚧 Files skipped from review as they are similar to previous changes (3)
- packages/expo/src/utils/hostedAuth.ts
- packages/expo/src/hooks/useHostedAuth.ts
- packages/expo/src/hooks/tests/useHostedAuth.test.ts
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 585a66c643
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
mikepitre
force-pushed
the
mike/hosted-mobile-sign-in
branch
from
585a66c to
d0e5c32
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d0e5c32c92
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1 participant
Summary
Adds the Expo client SDK surface for hosted auth through Account Portal.
Expo apps can now start a hosted sign-in or sign-up flow in the system browser, return through a native callback, and activate the single Clerk session that ClerkGo attaches to the native client.
What Changed
useHostedAuth()through the opt-in@clerk/expo/hosted-authsubpath.expo-web-browser/expo-auth-session.statefor callback correlation./clientpayload to the existing Clerk client and activates the created native session.Developer Experience
Apps may pass
mode: 'sign-in' | 'sign-up', a customredirectUrl, orauthSessionOptions. The default Expo redirect URI is enough for the simulator/local flow.Flow
state, and PKCE verifier/challenge.openAuthSessionAsync.state.rotating_token_noncewith the original PKCE verifier.setActivewith the created native session.Security
stateand verifies it on callback so the app only accepts the browser result for the auth attempt it initiated.Implementation Notes
Hosted auth is exposed from
@clerk/expo/hosted-authso apps that import the default@clerk/expopackage do not need to resolve optional Expo auth/browser/crypto peer dependencies unless they opt into this flow.The completion request is a physical
POST /v1/clientwith_method=GETin the form body. That lets the backend route to the existing/clientread/rotation path while keeping the PKCE verifier out of query strings and logs.The verifier-bound completion stays scoped to
packages/expo/src/utils/hostedAuth.ts. GenericClient.reload()remains the normal GET reload path, so ClerkJS core does not gain hosted-auth-specific branches.Screen Recording
Simulator.Screen.Recording.-.iPhone.Air.+.Watch.-.2026-06-24.at.14.08.05.mov
Related PRs