fix(backend): Enforce azp when configured by dominic-clerk · Pull Request #8877 · clerk/javascript

dominic-clerk · 2026-06-16T13:48:57Z

Description

Enforce the azp (authorized party) claim when authorizedParties is configured. Previously, a session token that was missing the azp claim was accepted even when authorizedParties was set, allowing the authorized-parties check to be bypassed by omitting the claim. Now, when authorizedParties is configured, a token with a missing or empty azp claim is rejected. Tokens without azp continue to be accepted when no authorizedParties are configured.

Related to SEC-313

To be a problem this needs a system emitting azp-less tokens in an environment where an app expects azp to be set. Attackers can't just drop the azp claim as this would make the signature invalid.

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

Summary by CodeRabbit

Bug Fixes
- Enhanced session token validation security: when authorized parties are configured, tokens with a missing or invalid authorized party claim are now properly rejected, preventing bypass of the authorized parties check. Tokens without this claim continue to be accepted when authorized parties are not configured.

Enforce the `azp` (authorized party) claim when `authorizedParties` is configured. Previously, a session token that was missing the `azp` claim was accepted even when `authorizedParties` was set, allowing the authorized-parties check to be bypassed by omitting the claim. Now, when `authorizedParties` is configured, a token with a missing or empty `azp` claim is rejected. Tokens without `azp` continue to be accepted when no `authorizedParties` are configured.

vercel · 2026-06-16T13:49:05Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	Jun 16, 2026 1:49pm
swingset	Ready	Preview, Comment	Jun 16, 2026 1:49pm

changeset-bot · 2026-06-16T13:49:10Z

🦋 Changeset detected

Latest commit: 527170f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
@clerk/backend	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

coderabbitai · 2026-06-16T13:49:18Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 8e8057a7-4092-4e9c-b09b-40e7c0d61ec7

📥 Commits

Reviewing files that changed from the base of the PR and between cc83980 and 527170f.

📒 Files selected for processing (3)

.changeset/warm-spies-double.md
packages/backend/src/jwt/__tests__/assertions.test.ts
packages/backend/src/jwt/assertions.ts

📝 Walkthrough

Walkthrough

The assertAuthorizedPartiesClaim function in packages/backend/src/jwt/assertions.ts is updated so that the early-return guard depends on authorizedParties being unset or empty rather than on azp being absent. When authorizedParties is configured, tokens with a missing or empty azp claim now throw TokenInvalidAuthorizedParties. Tests and a changeset entry are added to match.

Changes

azp enforcement in assertAuthorizedPartiesClaim

Layer / File(s)	Summary
`assertAuthorizedPartiesClaim` control flow fix and tests `packages/backend/src/jwt/assertions.ts`, `packages/backend/src/jwt/__tests__/assertions.test.ts`	Early-return condition is changed to key off `authorizedParties` being unset/empty; missing/empty `azp` now throws when `authorizedParties` is configured. Tests are split into a non-throw case (unconfigured) and a new throw case (configured with missing/empty `azp`).
Changeset entry `.changeset/warm-spies-double.md`	Adds a `@clerk/backend` patch changeset documenting the new `azp` enforcement behavior.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐇 Hop hop, the party gate stands firm,
No azp claim? You'll get the squirm!
When parties are listed, you must comply,
Empty tokens shall no longer slip by.
The warren is safe — the rabbit checks twice! 🔐

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(backend): Enforce azp when configured' directly describes the main security fix: enforcing the azp claim validation when authorizedParties is configured, which is the primary change across all modified files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

pkg-pr-new · 2026-06-16T13:51:59Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8877

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8877

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8877

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8877

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8877

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8877

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8877

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8877

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8877

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8877

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8877

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8877

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8877

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8877

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8877

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8877

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8877

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8877

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8877

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8877

commit: 527170f

github-actions · 2026-06-16T13:52:37Z

API Changes Report

Generated by Break Check on 2026-06-16T13:52:34.147Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

Report generated by Break Check

_{Last ran on 527170f.}

wobsoriano

Okay, I think I approved a bit too quickly.

This is at least a behavioral breaking change for any app that has authorizedParties configured but can still receive azp-less tokens. It does look like the correct security
behavior to me.

Discussed in Slack, Im in favor of rolling this out in shadow mode first https://github.com/clerk/dashboard/pull/9494

github-actions Bot added the backend label Jun 16, 2026

dominic-clerk requested review from jacekradko and wobsoriano June 17, 2026 11:32

wobsoriano approved these changes Jun 17, 2026

View reviewed changes

wobsoriano reviewed Jun 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(backend): Enforce azp when configured#8877

fix(backend): Enforce azp when configured#8877
dominic-clerk wants to merge 1 commit into
mainfrom
dc-fix-azp-when-configured

dominic-clerk commented Jun 16, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Jun 16, 2026

Uh oh!

changeset-bot Bot commented Jun 16, 2026

Uh oh!

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

pkg-pr-new Bot commented Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026

Uh oh!

wobsoriano left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dominic-clerk commented Jun 16, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Type of change

Summary by CodeRabbit

Uh oh!

vercel Bot commented Jun 16, 2026

Uh oh!

changeset-bot Bot commented Jun 16, 2026

🦋 Changeset detected

Uh oh!

coderabbitai Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

pkg-pr-new Bot commented Jun 16, 2026

Uh oh!

github-actions Bot commented Jun 16, 2026

API Changes Report

Summary

No API Changes Detected

Uh oh!

wobsoriano left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dominic-clerk commented Jun 16, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 16, 2026 •

edited

Loading