API key verification forwards client User-Agent, causing Python urllib requests to fail
维护者通常 1 天内回复
评估
- 难度
- 1/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 25/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 停滞
- 技术栈
- node.js, typescript
- 领域
- api, authentication
调研方向
The report names verifyAPIKey() and createBackendApiClient(options) in @clerk/backend, and includes a reproduction repository with an npm run repro script. Read the verification path and compare the outbound request's User-Agent with the incoming request; run the reproduction with both User-Agent values. Done when both requests authenticate successfully with the same credentials. An open linked pull request (#10358) indicates work is already underway.
由索引模型根据 Issue 内容生成。
描述
Preliminary Checks
-
I have reviewed the documentation: https://clerk.com/docs
-
I have searched for existing issues: https://github.com/clerk/javascript/issues
-
I have not already reached out to Clerk support via email or Discord (if you have, no need to open an issue here)
-
This issue is not a question, general help request, or anything other than a bug report directly related to Clerk. Please ask questions in our Discord community: https://clerk.com/discord.
Reproduction
https://github.com/jandorn/clerk-api-key-user-agent-repro
Publishable key
pk_live_Y2xlcmsudGVsZXNjb3BlLmVuZXJneSQ
Description
Steps to reproduce:
- Clone the reproduction repository and run
npm ci. - Copy
.env.exampleto.envand configure credentials from the same Clerk instance, including a valid API key. - Run
npm run repro.
The script uses unpatched @clerk/[email protected] and calls authenticateRequest(request, { acceptsToken: 'api_key' }) twice with the same credentials. Only the incoming User-Agent changes.
Expected behavior:
Both requests authenticate successfully.
Actual behavior:
Python-urllib/3.11→ upstream HTTP 403 (text/html),isAuthenticated: false, reason:unexpected-error.clerk-api-key-repro/1.0→ upstream HTTP 200 (application/json),isAuthenticated: true.
The full live output is included in the reproduction README.
Suspected cause:
verifyAPIKey() passes the authentication context to createBackendApiClient(options). The context's incoming userAgent overrides the SDK's default User-Agent.
Using the SDK User-Agent for this outbound request resolved the issue in our application:
const client = createBackendApiClient({ ...options, userAgent: USER_AGENT });
Environment
System:
OS: macOS 27.0.1
CPU: (15) arm64 Apple M5 Pro
Memory: 75.17 MB / 24.00 GB
Shell: 5.9 - /bin/zsh
Binaries:
Node: 23.11.0 - /opt/homebrew/bin/node
npm: 11.19.1 - /opt/homebrew/bin/npm
pnpm: 10.11.0 - /opt/homebrew/bin/pnpm
bun: 1.3.9 - /Users/jandorn/.bun/bin/bun
Browsers:
Chrome: 155.0.8059.85
Firefox: 144.0.2
Safari: 27.0.1
npmPackages:
@clerk/backend: 3.2.2 => 3.2.2
- 主要语言
- TypeScript
- 星标
- 1.8k
- 派生
- 483
- 平均合并
- 1 天 23 小时
- 30 天内合并 PR
- 325
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
clerk/javascript 的其他 Issue
-
ClerkAPIError drops meta.lockout_expires_in_seconds from user_locked errors可能已有人在做 @umeraamir69 于 4 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
clerk/javascript#10026 · 2 条评论 ·
维护者通常 1 天内回复
-
@clerk/nextjs: onBeforeSetActive never settles when invalidateCacheAction rejects (e.g. after a redeploy), so setActive and signOut hang forever可能已有人在做 @RaphaelFakhri 于 20 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
clerk/javascript#9987 · 1 条评论 ·
维护者通常 1 天内回复
-
needs-triage
难度 4/5 3-5 天 新手友好度 44/100
clerk/javascript#10413 · 1 条评论 ·
维护者通常 1 天内回复
-
Dev instances: clerk-js rewrites __clerk_db_jwt non-atomically, concurrent requests fail with dev-browser-missing可能已有人在做 @umeraamir69 于 3 天前认领。 未关闭
难度 4/5 3-5 天 新手友好度 35/100
clerk/javascript#10411 ·
维护者通常 1 天内回复
-
needs-triage
难度 4/5 3-5 天 新手友好度 55/100
clerk/javascript#10356 ·
维护者通常 1 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 77/100
Clouditera/VulnHunter#57 ·
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
bug bug:behavior clawsweeper:bulk-filed clawsweeper:fix-shape-clear clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:auth-provider issue-rating: 🦞 diamond lobster P2
难度 2/5 1-3 小时 新手友好度 76/100
openclaw/openclaw#185297 · 1 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 62/100
-
bug needs-triage
难度 2/5 1-3 小时 新手友好度 76/100
apex-dev-tools/apex-log-parser#199 ·
维护者通常 1 天内回复