fix(clerk-js): Stop retrying on `/verify` if the client cannot solve the challenge #5526

anagstef · 2025-04-03T18:20:36Z

Description

This PR:

Adds the captcha_action property on requests to the /verify endpoint in order to distinguish between heartbeat and requires_captcha
Stops the client from keep retrying to solve the captcha if they are not able to solve it (due to unsupported browser or other reasons)
Prevents the first /verify request on initialization if the client is captcha blocked, because components have not initialized yet.

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

changeset-bot · 2025-04-03T18:20:40Z

🦋 Changeset detected

Latest commit: f0e8ab5

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@clerk/clerk-js	Patch
@clerk/chrome-extension	Patch
@clerk/clerk-expo	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

vercel · 2025-04-03T18:20:40Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
clerk-js-sandbox	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Apr 8, 2025 11:32am

anagstef · 2025-04-03T18:20:57Z

!snapshot

clerk-cookie · 2025-04-03T18:23:00Z

Hey @anagstef - the snapshot version command generated the following package versions:

Package	Version
@clerk/agent-toolkit	0.0.18-snapshot.v20250403182140
@clerk/astro	2.5.1-snapshot.v20250403182140
@clerk/backend	1.26.1-snapshot.v20250403182140
@clerk/chrome-extension	2.2.25-snapshot.v20250403182140
@clerk/clerk-js	5.59.1-snapshot.v20250403182140
@clerk/elements	0.23.10-snapshot.v20250403182140
@clerk/clerk-expo	2.9.8-snapshot.v20250403182140
@clerk/expo-passkeys	0.2.2-snapshot.v20250403182140
@clerk/express	1.4.1-snapshot.v20250403182140
@clerk/fastify	2.2.1-snapshot.v20250403182140
@clerk/localizations	3.13.6-snapshot.v20250403182140
@clerk/nextjs	6.13.1-snapshot.v20250403182140
@clerk/nuxt	1.5.1-snapshot.v20250403182140
@clerk/clerk-react	5.25.7-snapshot.v20250403182140
@clerk/react-router	1.2.1-snapshot.v20250403182140
@clerk/remix	4.5.13-snapshot.v20250403182140
@clerk/shared	3.3.1-snapshot.v20250403182140
@clerk/tanstack-react-start	0.13.1-snapshot.v20250403182140
@clerk/testing	1.4.35-snapshot.v20250403182140
@clerk/themes	2.2.28-snapshot.v20250403182140
@clerk/types	4.50.3-snapshot.v20250403182140
@clerk/vue	1.4.7-snapshot.v20250403182140

Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit

npm i @clerk/[email protected] --save-exact

@clerk/astro

npm i @clerk/[email protected] --save-exact

@clerk/backend

npm i @clerk/[email protected] --save-exact

@clerk/chrome-extension

npm i @clerk/[email protected] --save-exact

@clerk/clerk-js

npm i @clerk/[email protected] --save-exact

@clerk/elements

npm i @clerk/[email protected] --save-exact

@clerk/clerk-expo

npm i @clerk/[email protected] --save-exact

@clerk/expo-passkeys

npm i @clerk/[email protected] --save-exact

@clerk/express

npm i @clerk/[email protected] --save-exact

@clerk/fastify

npm i @clerk/[email protected] --save-exact

@clerk/localizations

npm i @clerk/[email protected] --save-exact

@clerk/nextjs

npm i @clerk/[email protected] --save-exact

@clerk/nuxt

npm i @clerk/[email protected] --save-exact

@clerk/clerk-react

npm i @clerk/[email protected] --save-exact

@clerk/react-router

npm i @clerk/[email protected] --save-exact

@clerk/remix

npm i @clerk/[email protected] --save-exact

@clerk/shared

npm i @clerk/[email protected] --save-exact

@clerk/tanstack-react-start

npm i @clerk/[email protected] --save-exact

@clerk/testing

npm i @clerk/[email protected] --save-exact

@clerk/themes

npm i @clerk/[email protected] --save-exact

@clerk/types

npm i @clerk/[email protected] --save-exact

@clerk/vue

npm i @clerk/[email protected] --save-exact

…a captcha

…s-failing

anagstef · 2025-04-07T08:32:36Z

!snapshot

clerk-cookie · 2025-04-07T08:34:36Z

Hey @anagstef - the snapshot version command generated the following package versions:

Package	Version
@clerk/agent-toolkit	0.0.18-snapshot.v20250407083314
@clerk/astro	2.6.0-snapshot.v20250407083314
@clerk/backend	1.27.0-snapshot.v20250407083314
@clerk/chrome-extension	2.2.25-snapshot.v20250407083314
@clerk/clerk-js	5.59.1-snapshot.v20250407083314
@clerk/elements	0.23.10-snapshot.v20250407083314
@clerk/clerk-expo	2.9.8-snapshot.v20250407083314
@clerk/expo-passkeys	0.2.2-snapshot.v20250407083314
@clerk/express	1.4.1-snapshot.v20250407083314
@clerk/fastify	2.2.1-snapshot.v20250407083314
@clerk/localizations	3.13.6-snapshot.v20250407083314
@clerk/nextjs	6.14.0-snapshot.v20250407083314
@clerk/nuxt	1.5.1-snapshot.v20250407083314
@clerk/clerk-react	5.26.0-snapshot.v20250407083314
@clerk/react-router	1.2.1-snapshot.v20250407083314
@clerk/remix	4.5.13-snapshot.v20250407083314
@clerk/shared	3.4.0-snapshot.v20250407083314
@clerk/tanstack-react-start	0.13.1-snapshot.v20250407083314
@clerk/testing	1.4.35-snapshot.v20250407083314
@clerk/themes	2.2.28-snapshot.v20250407083314
@clerk/types	4.51.0-snapshot.v20250407083314
@clerk/vue	1.5.0-snapshot.v20250407083314

Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/agent-toolkit

npm i @clerk/[email protected] --save-exact

@clerk/astro

npm i @clerk/[email protected] --save-exact

@clerk/backend

npm i @clerk/[email protected] --save-exact

@clerk/chrome-extension

npm i @clerk/[email protected] --save-exact

@clerk/clerk-js

npm i @clerk/[email protected] --save-exact

@clerk/elements

npm i @clerk/[email protected] --save-exact

@clerk/clerk-expo

npm i @clerk/[email protected] --save-exact

@clerk/expo-passkeys

npm i @clerk/[email protected] --save-exact

@clerk/express

npm i @clerk/[email protected] --save-exact

@clerk/fastify

npm i @clerk/[email protected] --save-exact

@clerk/localizations

npm i @clerk/[email protected] --save-exact

@clerk/nextjs

npm i @clerk/[email protected] --save-exact

@clerk/nuxt

npm i @clerk/[email protected] --save-exact

@clerk/clerk-react

npm i @clerk/[email protected] --save-exact

@clerk/react-router

npm i @clerk/[email protected] --save-exact

@clerk/remix

npm i @clerk/[email protected] --save-exact

@clerk/shared

npm i @clerk/[email protected] --save-exact

@clerk/tanstack-react-start

npm i @clerk/[email protected] --save-exact

@clerk/testing

npm i @clerk/[email protected] --save-exact

@clerk/themes

npm i @clerk/[email protected] --save-exact

@clerk/types

npm i @clerk/[email protected] --save-exact

@clerk/vue

npm i @clerk/[email protected] --save-exact

…-if-verify-is-failing' into stefanos/fraud-566-stop-retrying-if-verify-is-failing

anagstef · 2025-04-07T14:47:03Z

packages/clerk-js/src/core/fraudProtection.ts

+        if (captchaParams?.captchaError !== 'modal_component_not_ready') {
+          await this.client.getOrCreateInstance().sendCaptchaToken(captchaParams);
+          this.captchaRetryCount = 0; // Reset the retry count on success
+        }


If it's the first /client request on initialization it will always fail because we always initialize the components after the first /client request.

packages/clerk-js/src/core/fraudProtection.ts

…s-failing

anagstef · 2025-04-08T11:31:23Z

!snapshot

clerk-cookie · 2025-04-08T11:32:53Z

Hey @anagstef - the snapshot version command generated the following package versions:

Package	Version
@clerk/chrome-extension	2.2.26-snapshot.v20250408113211
@clerk/clerk-js	5.59.2-snapshot.v20250408113211
@clerk/clerk-expo	2.9.9-snapshot.v20250408113211

Tip: Use the snippet copy button below to quickly install the required packages.
@clerk/chrome-extension

npm i @clerk/[email protected] --save-exact

@clerk/clerk-js

npm i @clerk/[email protected] --save-exact

@clerk/clerk-expo

npm i @clerk/[email protected] --save-exact

nikosdouvlis

as @anagstef raised, the logic here has become pretty complex and is due for a refactor. We'd also need to add some kind of UI for the C2 users explaining why the captcha failed

fix(clerk-js): Stop retrying if /verify fails

77fd01d

anagstef self-assigned this Apr 3, 2025

clerk-cookie added the clerk-js label Apr 3, 2025

Add a modal with remedation instructions for users that cannot solve …

89b3a84

…a captcha

vercel bot deployed to Preview April 4, 2025 15:48 View deployment

Remove the modal

5d4472f

vercel bot deployed to Preview April 7, 2025 08:04 View deployment

fix lint

cc8d7b1

vercel bot deployed to Preview April 7, 2025 08:13 View deployment

Merge branch 'main' into stefanos/fraud-566-stop-retrying-if-verify-i…

ee24898

…s-failing

vercel bot deployed to Preview April 7, 2025 08:18 View deployment

anagstef added 2 commits April 7, 2025 14:03

improve changeset

74352ee

Merge remote-tracking branch 'origin/stefanos/fraud-566-stop-retrying…

dffaede

…-if-verify-is-failing' into stefanos/fraud-566-stop-retrying-if-verify-is-failing

vercel bot deployed to Preview April 7, 2025 11:04 View deployment

Improve error message

79321e4

vercel bot deployed to Preview April 7, 2025 11:13 View deployment

Replace action with captcha_action

d1be96f

vercel bot deployed to Preview April 7, 2025 11:18 View deployment

anagstef requested a review from nikosdouvlis April 7, 2025 11:27

anagstef marked this pull request as ready for review April 7, 2025 11:27

anagstef requested review from octoper and panteliselef April 7, 2025 11:43

anagstef changed the title ~~fix(clerk-js): Stop retrying if /verify fails~~ fix(clerk-js): Stop retrying on /verify if the client cannot solve the challenge Apr 7, 2025

anagstef commented Apr 7, 2025

View reviewed changes

panteliselef reviewed Apr 7, 2025

View reviewed changes

packages/clerk-js/src/core/fraudProtection.ts Outdated Show resolved Hide resolved

packages/clerk-js/src/core/fraudProtection.ts Outdated Show resolved Hide resolved

Rename to captchaAttemptsExceeded

4eb9763

vercel bot deployed to Preview April 7, 2025 15:04 View deployment

panteliselef approved these changes Apr 7, 2025

View reviewed changes

Merge branch 'main' into stefanos/fraud-566-stop-retrying-if-verify-i…

f0e8ab5

…s-failing

vercel bot deployed to Preview April 8, 2025 11:32 View deployment

nikosdouvlis approved these changes Apr 8, 2025

View reviewed changes

anagstef merged commit eb67419 into main Apr 8, 2025
30 checks passed

anagstef deleted the stefanos/fraud-566-stop-retrying-if-verify-is-failing branch April 8, 2025 13:39

clerk-cookie mentioned this pull request Apr 8, 2025

ci(repo): Version packages #5559

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(clerk-js): Stop retrying on `/verify` if the client cannot solve the challenge #5526

fix(clerk-js): Stop retrying on `/verify` if the client cannot solve the challenge #5526

anagstef commented Apr 3, 2025 •

edited

Loading

changeset-bot bot commented Apr 3, 2025 •

edited

Loading

vercel bot commented Apr 3, 2025 •

edited

Loading

anagstef commented Apr 3, 2025

clerk-cookie commented Apr 3, 2025

anagstef commented Apr 7, 2025

clerk-cookie commented Apr 7, 2025

anagstef Apr 7, 2025

anagstef commented Apr 8, 2025

clerk-cookie commented Apr 8, 2025

nikosdouvlis left a comment

fix(clerk-js): Stop retrying on /verify if the client cannot solve the challenge #5526

fix(clerk-js): Stop retrying on /verify if the client cannot solve the challenge #5526

Conversation

anagstef commented Apr 3, 2025 • edited Loading

Description

Checklist

Type of change

changeset-bot bot commented Apr 3, 2025 • edited Loading

🦋 Changeset detected

vercel bot commented Apr 3, 2025 • edited Loading

anagstef commented Apr 3, 2025

clerk-cookie commented Apr 3, 2025

anagstef commented Apr 7, 2025

clerk-cookie commented Apr 7, 2025

anagstef Apr 7, 2025

Choose a reason for hiding this comment

anagstef commented Apr 8, 2025

clerk-cookie commented Apr 8, 2025

nikosdouvlis left a comment

Choose a reason for hiding this comment

fix(clerk-js): Stop retrying on `/verify` if the client cannot solve the challenge #5526

fix(clerk-js): Stop retrying on `/verify` if the client cannot solve the challenge #5526

anagstef commented Apr 3, 2025 •

edited

Loading

changeset-bot bot commented Apr 3, 2025 •

edited

Loading

vercel bot commented Apr 3, 2025 •

edited

Loading