You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(chrome-extension): avoid remote loaders and initialize production auth - #10565
@clerk/chrome-extension uses ClerkJS's no-RHC build, but that build could still insert Device Intelligence scripts supplied by the environment configuration. Chrome extensions cannot load remotely hosted code, so the no-RHC build now omits Device Intelligence loader initialization. Regular browser builds keep the configured loading behavior. The no-RHC build check now fails if the loader code reappears in either the ESM or CommonJS output.
Production extension requests now declare native API mode from the first request, before a client token is stored. Previously only requests with a stored token included it, so a fresh production extension could not initialize authentication.
The chrome-extension integration suite gains live sign-in and sign-up flows against development and production instances, run without a Testing Token and with the extension CSP enforced. The test extension has a fixed ID, so its origin is added once to the shared sessions-prod-1 instance and kept there, and test mode is left enabled on that instance so concurrent CI runs cannot undo each other's setup. Development sign-up from an extension is currently rejected, and the test asserts that rejection.
Checklist
pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
No actionable comments were generated in the recent review.
Walkthrough
The changes conditionally initialize Protect in no-RHC builds and expand checks for no-RHC bundles and Chrome extension loading. They move production request marking before JWT lookup, add a sign-up view to the extension template, and add configurable development and production authentication tests.
The authentication tests now detect both the documented development rejection and future sign-up success, with no concrete merge-blocking risk remaining.
Pre-merge checks: 4 · 1
Failed checks: 1 warning
Check name
Status
Explanation
Resolution
Docstring Coverage
Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…
Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed checks: 4 passed
Check name
Status
Explanation
Title check
The title names the chrome-extension package and two changes: avoiding remote loaders in the no-RHC build and initializing production authentication. The changeset matches both: the no-RHC build omits…
Description check
The description states the bug and the fix. It explains that the no-RHC build could insert Device Intelligence scripts, and that production extension requests now declare native API mode before a clie…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the chrome-extension package and two changes: avoiding remote loaders in the no-RHC build and initializing production authentication. The changeset matches both: the no-RHC build omits Device Intelligence loader initialization, and production extension requests now declare native API mode from the first request. The title is specific and describes the main change without listing files.
Full details: Description check
Explanation
The description states the bug and the fix. It explains that the no-RHC build could insert Device Intelligence scripts, and that production extension requests now declare native API mode before a client token is stored. It also covers the new CI check and the new integration tests, which match the changed files.
Full details: Docstring Coverage
Explanation
Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 10 files.
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Linked repositories: Some configured repositories could not be included in this review. Cross-repository analysis may be incomplete. Please check linked-repository access and settings.
CodeRabbit Verify
Run CodeRabbit Verify to test the changes in this pull request.
Included review availability: This review used your included allowance. 8 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.
mwickett
changed the title
fix(js): omit Device Intelligence loaders from no-RHC builds
fix(chrome-extension): avoid remote loaders and initialize production auth
Oct 31, 2026
Pin the test extension ID with a manifest key so its allowed origin is stable,
and only ever add fixture settings: the origin is added once and never removed,
and test mode is enabled once and left on. Concurrent CI runs can no longer
undo each other's setup. When test mode is enabled, wait for the Frontend API
environment to report it before running the flows.
The reason will be displayed to describe this comment to others. Learn more.
I took a look at the review and it looks like it removes the remotely hosted code that was being included.
I also looked into why this slipped through, as there were checks added by Tom to prevent this. It looks like the guard moved from clerk-js to shared for Core 3, but after that move it was not longer working. I created CORE-4281 to restore those checks.
Tested on dae1f31d, untouched since — Before, the no-RHC bundle inserted both configured loader scripts into the extension popup and Chrome's extension CSP blocked them. After, it inserts none, makes no remote script request and triggers no CSP violation, on both production and development keys.
Merge-base
This PR dae1f31d
Merge-base
This PR dae1f31d
Also checked · 3 match · 1 not run
Live extension sign-in and sign-up · Blocked Prod first request declares native mode Regular builds still load configured loaders Build check catches loader code
Important
Blocked on missing secrets
Live extension sign-in and sign-up: Still no Clerk development or production instance keys (INTEGRATION_INSTANCE_KEYS) in the sandbox, and the extension origin must be allowed on sessions-prod-1, so the live flows cannot run.
Proof on 0af8fafd (from dae1f31d) · Did Proof get it right? Yes · No
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
royanger
left a comment
Description
@clerk/chrome-extensionuses ClerkJS's no-RHC build, but that build could still insert Device Intelligence scripts supplied by the environment configuration. Chrome extensions cannot load remotely hosted code, so the no-RHC build now omits Device Intelligence loader initialization. Regular browser builds keep the configured loading behavior. The no-RHC build check now fails if the loader code reappears in either the ESM or CommonJS output.Production extension requests now declare native API mode from the first request, before a client token is stored. Previously only requests with a stored token included it, so a fresh production extension could not initialize authentication.
The chrome-extension integration suite gains live sign-in and sign-up flows against development and production instances, run without a Testing Token and with the extension CSP enforced. The test extension has a fixed ID, so its origin is added once to the shared
sessions-prod-1instance and kept there, and test mode is left enabled on that instance so concurrent CI runs cannot undo each other's setup. Development sign-up from an extension is currently rejected, and the test asserts that rejection.Checklist
pnpm testruns as expected.pnpm buildruns as expected.Type of change