fix(nextjs): allow Clerk protection hosts on all ports in connect-src by mwickett · Pull Request #9458 · clerk/javascript

mwickett · 2026-08-14T20:54:22Z

Description

The contentSecurityPolicy option generated a connect-src listing https://*.protect.clerk.com. A CSP source expression with no port matches the scheme's default port only, so requests to Clerk's abuse and fraud protection hosts on any other port were blocked by the generated policy — surfacing as connect-src violations in applications that enable the option.

connect-src now uses a port-inclusive source. script-src and frame-src are deliberately unchanged, as those hosts are only requested on 443.

Checklist

pnpm test runs as expected.
pnpm build runs as expected.
(If applicable) JSDoc comments have been added or updated for any package exports
(If applicable) Documentation has been updated

Type of change

The generated connect-src listed https://*.protect.clerk.com, and a CSP source with no port matches the scheme's default port only. Requests to those hosts on other ports were therefore blocked by the generated policy. Use a port-inclusive source for connect-src. script-src and frame-src are unchanged, as those are only requested on 443.

vercel · 2026-08-14T20:54:28Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
swingset	Ready	Preview	Aug 14, 2026 9:05pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Skipped		Aug 14, 2026 9:05pm

changeset-bot · 2026-08-14T20:54:30Z

🦋 Changeset detected

Latest commit: 2c628d6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@clerk/nextjs	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

pkg-pr-new · 2026-08-14T20:56:23Z

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9458

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9458

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9458

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9458

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9458

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9458

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9458

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9458

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9458

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9458

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9458

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9458

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9458

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9458

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9458

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9458

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9458

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9458

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9458

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9458

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9458

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9458

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9458

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9458

commit: 2c628d6

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 631545bbed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-14T20:56:48Z

+        // connect-src carries the port wildcard because those hosts are also requested on
+        // ports other than 443, which a portless source would not match.


Condense the explanation to one line

This new explanation spans two // lines even though the repository requires warranted comments to be a single terse line. Please either remove it—the table already makes the directive-specific difference explicit—or condense it to one line to comply with the documented comment policy.

AGENTS.md reference: AGENTS.md:L13-L13

Useful? React with 👍 / 👎.

coderabbitai · 2026-08-14T20:57:17Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: e4a9878c-a172-42b8-8a3c-14be05b991c6

📥 Commits

Reviewing files that changed from the base of the PR and between 631545b and 2c628d6.

📒 Files selected for processing (1)

packages/nextjs/src/server/__tests__/content-security-policy.test.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

clerk/clerk_go (manual)
clerk/dashboard (manual)
clerk/accounts (manual)
clerk/backoffice (manual)
clerk/clerk (manual)
clerk/clerk-docs (manual)
clerk/cloudflare-workers (manual)
clerk/clerk-ios (auto-detected)
clerk/cli (auto-detected)
clerk/clerk-android (auto-detected)

🚧 Files skipped from review as they are similar to previous changes (1)

packages/nextjs/src/server/tests/content-security-policy.test.ts

📝 Walkthrough

Walkthrough

The default Next.js CSP now allows connections to https://*.protect.clerk.com on any port. The script-src and frame-src directives retain the portless protection origin. CSP tests cover default, report-only, merged, preserved, converted, and complete policy outputs. A patch changeset documents the update.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 2c628

This localized CSP fix broadens Clerk protection-host connectivity to supported ports without changing script or frame loading behavior, and no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: manovotny, zourzouvillys

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the CSP change, its purpose, and the unchanged script-src and frame-src behavior.
Title check	✅ Passed	The title clearly and concisely identifies the Next.js CSP fix for Clerk protection hosts on all ports.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-14T20:57:32Z

API Changes Report

Generated by Break Check on 2026-08-14T21:05:18.251Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

Report generated by Break Check

_{Last ran on 2c628d6.}

github-actions Bot added the nextjs label Aug 14, 2026

vercel Bot deployed to Preview – clerk-js-sandbox August 14, 2026 20:55 View deployment

chatgpt-codex-connector Bot reviewed Aug 14, 2026

View reviewed changes

vercel Bot deployed to Preview – swingset August 14, 2026 20:56 View deployment

mwickett requested review from manovotny and zourzouvillys August 14, 2026 20:57

test(nextjs): condense the connect-src comment to a single line

2c628d6

vercel Bot temporarily deployed to Preview – clerk-js-sandbox August 14, 2026 21:02 Inactive

vercel Bot deployed to Preview – swingset August 14, 2026 21:05 View deployment

Navigation Menu

Uh oh!

fix(nextjs): allow Clerk protection hosts on all ports in connect-src - #9458

fix(nextjs): allow Clerk protection hosts on all ports in connect-src#9458
mwickett wants to merge 2 commits into
mainfrom
mwickett/csp-protect-connect-src-ports

mwickett commented Aug 14, 2026

Uh oh!

vercel Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 14, 2026

Uh oh!

coderabbitai Bot commented Aug 14, 2026 •

edited

Loading

Walkthrough

Uh oh!

github-actions Bot commented Aug 14, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		// connect-src carries the port wildcard because those hosts are also requested on
		// ports other than 443, which a portless source would not match.

Uh oh!

Conversation

mwickett commented Aug 14, 2026

Description

Checklist

Type of change

Uh oh!

vercel Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

pkg-pr-new Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 14, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Uh oh!

github-actions Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

API Changes Report

Summary

No API Changes Detected

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Aug 14, 2026 •

edited

Loading

changeset-bot Bot commented Aug 14, 2026 •

edited

Loading

pkg-pr-new Bot commented Aug 14, 2026 •

edited

Loading

coderabbitai Bot commented Aug 14, 2026 •

edited

Loading

github-actions Bot commented Aug 14, 2026 •

edited

Loading