Skip to content

fix(backend): harden FAPI proxy resilience and spec compliance#8163

Open
brkalow wants to merge 4 commits intomainfrom
brkalow/proxy-hardening
Open

fix(backend): harden FAPI proxy resilience and spec compliance#8163
brkalow wants to merge 4 commits intomainfrom
brkalow/proxy-hardening

Conversation

@brkalow
Copy link
Copy Markdown
Member

@brkalow brkalow commented Mar 25, 2026

Summary

  • Propagate client abort signal to upstream fetch() to prevent zombie requests when clients disconnect
  • Strip dynamic hop-by-hop headers listed in the Connection header per RFC 7230 Section 6.1, for both request and response header copying
  • Support request bodies on any HTTP method (e.g., DELETE-with-body) by checking request.body !== null instead of a method allowlist
  • Add Cache-Control: no-store to all error responses to prevent CDN/browser caching of transient errors
  • Only set duplex: 'half' when the request actually has a body, avoiding unnecessary option on bodyless requests
  • Converted HOP_BY_HOP_HEADERS from array to Set for O(1) lookups

Test plan

  • Existing proxy tests continue to pass (82 tests)
  • New test: DELETE request with body is forwarded with duplex: 'half'
  • New test: Abort signal from incoming request is propagated to fetch
  • New test: Error responses (500 and 502) include Cache-Control: no-store
  • New test: Dynamic hop-by-hop headers listed in Connection header are stripped from forwarded requests

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Bug Fixes

    • Improved proxy behavior: support DELETE requests with bodies, reliable request-body handling during proxying, always forward abort signals, ensure error responses are not cached, and correctly strip dynamic hop-by-hop headers.
  • Tests

    • Added tests verifying DELETE-with-body forwarding, signal propagation, cache-control on failures, and dynamic hop-by-hop header stripping.
  • Chores

    • Prepared a patch release entry for the backend package.

…ipping, and DELETE body support

- Propagate client abort signal to upstream fetch to prevent zombie requests
- Strip dynamic hop-by-hop headers listed in the Connection header (RFC 7230)
- Support request bodies on DELETE (and any method), not just POST/PUT/PATCH
- Add Cache-Control: no-store to error responses to prevent CDN caching
- Only set duplex option when request has a body

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Mar 25, 2026

🦋 Changeset detected

Latest commit: 545a88c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages
Name Type
@clerk/backend Patch
@clerk/agent-toolkit Patch
@clerk/astro Patch
@clerk/express Patch
@clerk/fastify Patch
@clerk/hono Patch
@clerk/nextjs Patch
@clerk/nuxt Patch
@clerk/react-router Patch
@clerk/tanstack-react-start Patch
@clerk/testing Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new
Copy link
Copy Markdown

pkg-pr-new bot commented Mar 25, 2026

Open in StackBlitz

@clerk/agent-toolkit

npm i https://pkg.pr.new/@clerk/agent-toolkit@8163

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8163

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8163

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8163

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8163

@clerk/dev-cli

npm i https://pkg.pr.new/@clerk/dev-cli@8163

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8163

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8163

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8163

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8163

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8163

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8163

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8163

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8163

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8163

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8163

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8163

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8163

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8163

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8163

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8163

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8163

commit: 545a88c

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 25, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5ac94b4b-ea1a-4b34-83bc-8ea4d58cb185

📥 Commits

Reviewing files that changed from the base of the PR and between 1fbdcef and 545a88c.

📒 Files selected for processing (1)
  • .changeset/tough-ghosts-ask.md

📝 Walkthrough

Walkthrough

Proxy logic changed to use a Set for hop-by-hop headers and added getDynamicHopByHopHeaders(headers: Headers) to parse names from the Connection header. Request body detection now uses request.body !== null; when a body is present duplex: 'half' is set and request.signal is forwarded to upstream fetch. JSON error responses now include Cache-Control: no-store. Tests were added for DELETE with a body and duplex: 'half', signal propagation, consistent cache-control on failures (config 500 and upstream 502), and dynamic hop-by-hop header stripping.

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title directly summarizes the main changes: hardening the FAPI proxy's resilience and spec compliance through fixes like abort signal propagation, hop-by-hop header stripping per RFC 7230, dynamic body detection, and cache-control headers.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Comment @coderabbitai help to get the list of available commands and usage tips.

@vercel
Copy link
Copy Markdown

vercel bot commented Mar 25, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
clerk-js-sandbox Ready Ready Preview, Comment Mar 27, 2026 9:42pm

Request Review

@jacekradko

This comment was marked as outdated.

@jacekradko

This comment was marked as resolved.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.changeset/tough-ghosts-ask.md:
- Line 5: The changeset summary contains a spelling mistake: replace the
misspelled token "aobrt" with "abort" in the summary sentence (the phrase
"adding support for aobrt signals" should read "adding support for abort
signals") so the release notes/changelog shows the correct word; update the
summary text in the changeset file where that token appears.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: a8f5d12c-abae-4778-9f39-edecdb62d566

📥 Commits

Reviewing files that changed from the base of the PR and between 2809448 and 1fbdcef.

📒 Files selected for processing (1)
  • .changeset/tough-ghosts-ask.md

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants