feat(clerk-js): __session cookie Partitioned attribute

[jacekradko]

Description

Updating the way we set the __session cookie by adding the Partitioned attribute in secure contexts. Previously, our session cookie was set without this attribute, which could lead to potential cross-site issues. Now, we ensure that before setting the new cookie with the Partitioned attribute, any existing __session cookies are removed to prevent conflicts with cookies without the Partitioned attribute as there is no way to distinguish them once they are set.

Fixes: SDKI-898

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
clerk-js-sandbox	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Apr 25, 2025 8:52pm

[changeset-bot]

🦋 Changeset detected

Latest commit: 0c62cd0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@clerk/clerk-js	Minor
@clerk/chrome-extension	Patch
@clerk/clerk-expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Copilot]

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

Comments suppressed due to low confidence (2)

packages/clerk-js/src/core/auth/cookies/session.ts:34

• [nitpick] Consider renaming 'partitioned' to 'isPartitioned' to make the boolean nature of the variable more explicit.

const partitioned = secure;

packages/clerk-js/src/core/auth/cookies/session.ts:38

• [nitpick] Review the removal logic in the 'if (partitioned)' block; consider reusing the common cookie removal function to ensure consistency and reduce duplicated logic.

if (partitioned) {

[jacekradko]

!snapshot

[clerk-cookie]

Hey @jacekradko - the snapshot version command generated the following package versions:

Package	Version
@clerk/agent-toolkit	0.0.25-snapshot.v20250421150930
@clerk/astro	2.6.7-snapshot.v20250421150930
@clerk/backend	1.29.2-snapshot.v20250421150930
@clerk/chrome-extension	2.2.32-snapshot.v20250421150930
@clerk/clerk-js	5.62.0-snapshot.v20250421150930
@clerk/elements	0.23.17-snapshot.v20250421150930
@clerk/clerk-expo	2.9.15-snapshot.v20250421150930
@clerk/expo-passkeys	0.2.9-snapshot.v20250421150930
@clerk/express	1.4.8-snapshot.v20250421150930
@clerk/fastify	2.2.8-snapshot.v20250421150930
@clerk/localizations	3.13.13-snapshot.v20250421150930
@clerk/nextjs	6.17.0-snapshot.v20250421150930
@clerk/nuxt	1.5.8-snapshot.v20250421150930
@clerk/clerk-react	5.29.0-snapshot.v20250421150930
@clerk/react-router	1.2.8-snapshot.v20250421150930
@clerk/remix	4.5.20-snapshot.v20250421150930
@clerk/shared	3.7.3-snapshot.v20250421150930
@clerk/tanstack-react-start	0.13.8-snapshot.v20250421150930
@clerk/testing	1.5.0-snapshot.v20250421150930
@clerk/themes	2.2.35-snapshot.v20250421150930
@clerk/types	4.55.0-snapshot.v20250421150930
@clerk/vue	1.6.4-snapshot.v20250421150930

Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit

npm i @clerk/[email protected] --save-exact

@clerk/astro

npm i @clerk/[email protected] --save-exact

@clerk/backend

npm i @clerk/[email protected] --save-exact

@clerk/chrome-extension

npm i @clerk/[email protected] --save-exact

@clerk/clerk-js

npm i @clerk/[email protected] --save-exact

@clerk/elements

npm i @clerk/[email protected] --save-exact

@clerk/clerk-expo

npm i @clerk/[email protected] --save-exact

@clerk/expo-passkeys

npm i @clerk/[email protected] --save-exact

@clerk/express

npm i @clerk/[email protected] --save-exact

@clerk/fastify

npm i @clerk/[email protected] --save-exact

@clerk/localizations

npm i @clerk/[email protected] --save-exact

@clerk/nextjs

npm i @clerk/[email protected] --save-exact

@clerk/nuxt

npm i @clerk/[email protected] --save-exact

@clerk/clerk-react

npm i @clerk/[email protected] --save-exact

@clerk/react-router

npm i @clerk/[email protected] --save-exact

@clerk/remix

npm i @clerk/[email protected] --save-exact

@clerk/shared

npm i @clerk/[email protected] --save-exact

@clerk/tanstack-react-start

npm i @clerk/[email protected] --save-exact

@clerk/testing

npm i @clerk/[email protected] --save-exact

@clerk/themes

npm i @clerk/[email protected] --save-exact

@clerk/types

npm i @clerk/[email protected] --save-exact

@clerk/vue

npm i @clerk/[email protected] --save-exact

[Copilot]

Pull Request Overview

This PR introduces a new feature that sets the __session cookie with the Partitioned attribute in secure contexts while ensuring any existing non-partitioned cookies are removed to avoid conflicts. Key changes include:

• Exporting a new entry point (index.chips.ts) for the CHIP variant.
• Updating the session cookie handler to support the Partitioned attribute and remove existing cookies before setting the new ones.
• Adding a new variant (clerkCHIPS) in the rspack and jest configurations, along with corresponding build flag definitions.

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/clerk-js/src/index.chips.ts	Adds a new entry export for the CHIP variant.
packages/clerk-js/src/core/auth/cookies/session.ts	Implements the Partitioned attribute support and cookie removal.
packages/clerk-js/rspack.config.js	Introduces the new variant clerkCHIPS and related build flag.
packages/clerk-js/jest.config.js	Updates globals to include the new variant flag.
.changeset/plain-crabs-move.md	Documents the minor version bump and change description.

Comments suppressed due to low confidence (1)

packages/clerk-js/src/core/auth/cookies/session.ts:27

• The removal order of cookies has been reversed compared to the original implementation. Please verify that calling sessionCookie.remove() before suffixedSessionCookie.remove() does not introduce any unintended behavior in secure contexts.

suffixedSessionCookie.remove();

[panteliselef]

These look good to me, I added a question about the new variant

[panteliselef]

Are we actually shipping this variant or it is a temporary thing ?

[jacekradko]

We would ship it and pin specific instances to it