Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

handleRedirectCallback is not idempotent: SSO callback runs twice and the second signUp.create({ transfer: true }) fails with "There is no account to transfer"

Aperta
  • Qualcosa non va?
#10,510 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
next.js, react, typescript
Ambito
authentication, backend-api-design

Direzione di ricerca

Start with the three named entry points: packages/ui/src/common/SSOCallback.tsx, packages/clerk-js/src/core/clerk.ts, and packages/react/src/isomorphicClerk.ts. Trace the callback effect and redirect handling, then locate tests for these paths and reproduce the duplicate call behavior. Done means repeated handling of one OAuth return does not create duplicate transfers and callback rejections reach the caller.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Preliminary Checks
Reproduction

Source-level, see Description. No minimal repro: the double mount happens in real Chrome and Firefox but never in headless Chromium.

Publishable key

N/A

Description

After going from @clerk/nextjs 7.7.9 to 7.9.17, new users signing up with Google via the prebuilt <SignIn> started failing with "There is no account to transfer". Same clerk-js (6.39.0) before and after. Before: every new-user OAuth return sent one transfer. After: most sent two, and the second one failed.

Steps to reproduce:

  1. Prebuilt <SignIn> on a path-routed page, Google OAuth on, legal consent required
  2. Continue with Google using a Google account that has no Clerk user
  3. Finish Google consent, land on /sign-in/sso-callback

Expected behavior:

One POST /v1/client/sign_ups?transfer=true, then the legal consent step.

Actual behavior:

Two POST /v1/client/sign_ups?transfer=true, 4 to 200 ms apart. The first creates the sign-up (missing_requirements). The second fails with account_transfer_invalid and the user is sent back to sign-in. Once both succeeded and left two half done sign-ups.

The SignIn tree mounts twice. On a plain /sign-in load in real Chrome, useAutoFillPasskey sends two identical POST /v1/client/sign_ins in the same ms with different ids:
https://github.com/clerk/javascript/blob/6857df6841fb044f88e69f978917d8b8e8040d67/packages/ui/src/components/SignIn/SignInStart.tsx#L60

So SSOCallback calls handleRedirectCallback twice. Nothing stops the second call:

Workaround: own sso-callback page that calls window.Clerk.handleRedirectCallback once per callback URL per page load.

Ask:

  1. Make handleRedirectCallback idempotent per OAuth return (or dedupe in-flight calls)
  2. Let IsomorphicClerk pass the rejection through
Environment
@clerk/nextjs 7.9.17, @clerk/react 6.17.8, @clerk/shared 4.40.0, clerk-js 6.39.0 to 6.41.0, @clerk/ui 1.42.0, next 16.4.1, react 19.2.8, Chrome and Firefox (current stable)
Lingua principale
TypeScript
Stelle
1.8k
Fork
483
Merge medio
1g 20h
PR unite (30g)
363

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di clerk/javascript

Tutte le issue di clerk/javascript

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.