Skip to content

Conversation

@nikosdouvlis
Copy link
Member

Summary

Updates all custom flow documentation to include the new decorateUrl function in navigate callbacks, enabling Safari ITP cookie refresh support.

  • Updated 25 documentation files with the decorateUrl pattern
  • Covers all authentication custom flows (current and legacy)
  • Includes Expo partial files

Why

Safari's Intelligent Tracking Prevention (ITP) limits cookies set via API responses from CNAME-cloaked subdomains to 7 days. This causes unexpected session expiration for Safari users who don't visit frequently. The decorateUrl function wraps destination URLs and may return an absolute URL when cookie refresh is needed.

The Pattern

All navigate callbacks now use:

navigate: async ({ session, decorateUrl }) => {
  const url = decorateUrl('/')
  if (url.startsWith('http')) {
    window.location.href = url
  } else {
    router.push(url)
  }
}

Related

Test plan

🤖 Generated with Claude Code

Why:
Safari's Intelligent Tracking Prevention (ITP) limits cookies set via API
responses from CNAME-cloaked subdomains to 7 days. This causes unexpected
session expiration for Safari users who don't visit frequently. The new
decorateUrl function in setActive/finalize navigate callbacks enables
automatic cookie refresh when needed.

What changed:
- Updated 25 doc files with decorateUrl pattern in navigate callbacks
- Pattern wraps destination URLs and checks if result is absolute (http)
  to determine whether to use window.location.href or router.push()
- Covers all custom flows: auth, legacy auth, Expo partials
- Skipped billing checkout finalize() - different API, not affected

Files: oauth-connections, sign-in-or-up, email-password, email-password-mfa,
email-sms-otp, passkeys, enterprise-connections, legal-acceptance,
embedded-email-links, multi-session-applications, session-tasks,
error-handling, forgot-password, application-invitations, expo partials
@nikosdouvlis nikosdouvlis requested a review from a team as a code owner February 4, 2026 11:27
@vercel
Copy link

vercel bot commented Feb 4, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clerk-docs Ready Ready Preview Feb 10, 2026 3:48pm

Request Review

@alexisintech alexisintech force-pushed the nikos/user4475-udpate-docs-with-decorateurl branch from e3368ab to c7a70ee Compare February 6, 2026 21:05
@alexisintech
Copy link
Member

alexisintech commented Feb 6, 2026

does this only apply to navigate() for setActive(), or does it apply to the navigate() callback for finalize() as well? (checkout.finalize({ navigate }))

Screenshot 2026-02-06 at 16 04 53

…acks

The navigate callback receives an object { session, decorateUrl }, not
decorateUrl directly. Without destructuring, decorateUrl('/')  would
throw at runtime.
manovotny and others added 2 commits February 9, 2026 16:18
…-docs-with-decorateurl

# Conflicts:
#	docs/reference/components/authentication/task-choose-organization.mdx
#	docs/reference/components/authentication/task-reset-password.mdx
#	docs/reference/components/billing/subscription-details-button.mdx
#	docs/reference/hooks/use-subscription.mdx
#	docs/reference/nextjs/errors/auth-was-called.mdx
- Use `url` variable instead of hardcoded '/' in else branch (legacy/application-invitations)
- Replace `router.push` with `window.location.href` in vanilla JS examples (multi-session, clerk.mdx)
- Add missing `return` after currentTask check to prevent fall-through navigation
- Remove `window.location.href` from Expo examples where it doesn't exist in React Native
…te-docs-with-decorateurl

# Conflicts:
#	docs/guides/development/custom-flows/authentication/legacy/email-password.mdx
#	docs/guides/development/custom-flows/authentication/legacy/legal-acceptance.mdx
#	docs/guides/development/custom-flows/authentication/legacy/oauth-connections.mdx
#	docs/guides/development/custom-flows/authentication/legacy/sign-in-or-up.mdx
#	docs/reference/components/authentication/task-choose-organization.mdx
#	docs/reference/components/authentication/task-reset-password.mdx
#	docs/reference/components/billing/subscription-details-button.mdx
#	docs/reference/hooks/use-subscription.mdx
#	docs/reference/nextjs/errors/auth-was-called.mdx
Copy link
Member

@alexisintech alexisintech left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks nikos 😸💖

@nikosdouvlis nikosdouvlis merged commit c839e4c into core-3 Feb 10, 2026
2 checks passed
@nikosdouvlis nikosdouvlis deleted the nikos/user4475-udpate-docs-with-decorateurl branch February 10, 2026 20:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants