fix(backend): Remove unnecessary custom cookie parsing

.changeset/fresh-parrots-decide.md

@@ -0,0 +1,6 @@
+---
+'@clerk/backend': patch
+---
+
+Fix `Cookie` header parsing in `authenticateRequest()` to follow RFC 6265 and guard against a non-string `iss`. Legitimate cookies and JWTs are unaffected.
+

packages/backend/src/tokens/__tests__/authenticateContext.test.ts

@@ -212,6 +212,24 @@ describe('AuthenticateContext', () => {
         expect(context.clientUat.toString()).toBe('0');
       });
     });
+
+    describe('malformed un-suffixed session token', () => {
+      it('falls back to suffixed cookies when the token has a non-string issuer', async () => {
+        const headers = new Headers({
+          cookie: createCookieHeader({
+            __session: createJwt({ payload: { iss: 123 as unknown as string } }),
+            __client_uat_MqCvchyS: suffixedClientUat,
+            __session_MqCvchyS: suffixedSession,
+          }),
+        });
+        const clerkRequest = createClerkRequest(new Request('http://example.com', { headers }));
+
+        const context = await createAuthenticateContext(clerkRequest, { publishableKey: pkLive });
+
+        expect(context.usesSuffixedCookies()).toBe(true);
+        expect(context.sessionTokenInCookie).toBe(suffixedSession);
+      });
+    });
   });
 
   describe('relative proxyUrl resolution', () => {

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -89,12 +89,46 @@ describe('createClerkRequest', () => {
       expect(req.cookies.get('foo')).toBe('bar');
     });
 
-    it('should parse and return cookies with special characters', () => {
+    it('should percent-decode cookie values', () => {
+      const req = createClerkRequest(
+        new Request('http://localhost:3000', { headers: new Headers({ cookie: 'foo=hello%20world' }) }),
+      );
+      expect(req.cookies.get('foo')).toBe('hello world');
+    });
+
+    it('should not treat encoded delimiters inside a value as cookie separators', () => {
       const req = createClerkRequest(
         new Request('http://localhost:3000', { headers: new Headers({ cookie: 'foo=%20bar%3B%20baz%3Dqux' }) }),
       );
-      expect(req.cookies.get('foo')).toBe('bar');
-      expect(req.cookies.get('baz')).toBe('qux');
+      expect(req.cookies.get('foo')).toBe(' bar; baz=qux');
+      expect(req.cookies.get('baz')).toBeUndefined();
+    });
+
+    it('should not let an encoded value forge a session cookie', () => {
+      const req = createClerkRequest(
+        new Request('http://localhost:3000', {
+          headers: new Headers({ cookie: 'sid=x%3B__session%3Dforged%3B__client_uat%3D1700000000' }),
+        }),
+      );
+      expect(req.cookies.get('sid')).toBe('x;__session=forged;__client_uat=1700000000');
+      expect(req.cookies.get('__session')).toBeUndefined();
+      expect(req.cookies.get('__client_uat')).toBeUndefined();
+    });
+
+    it('should keep the first value when a cookie name is repeated', () => {
+      const req = createClerkRequest(
+        new Request('http://localhost:3000', { headers: new Headers({ cookie: '__session=first; __session=second' }) }),
+      );
+      expect(req.cookies.get('__session')).toBe('first');
+    });
+
+    it('should not throw on malformed percent-sequences', () => {
+      const req = createClerkRequest(
+        new Request('http://localhost:3000', { headers: new Headers({ cookie: 'foo=%C0; bar=100%D0; baz=ok' }) }),
+      );
+      expect(req.cookies.get('foo')).toBe('%C0');
+      expect(req.cookies.get('bar')).toBe('100%D0');
+      expect(req.cookies.get('baz')).toBe('ok');
     });
 
     it('should parse and return cookies even if no cookie header exists', () => {

packages/backend/src/tokens/authenticateContext.ts

@@ -386,6 +386,11 @@ class AuthenticateContext implements AuthenticateContext {
     if (errors) {
       return false;
     }
+    // `decodeJwt` only JSON-parses the payload, so `iss` is an unvalidated attacker-supplied
+    // value here — this runs before any signature verification.
+    if (typeof data.payload.iss !== 'string') {
+      return false;
+    }
     const tokenIssuer = data.payload.iss.replace(/https?:\/\//gi, '');
     // Use original frontend API for token validation since tokens are issued by the actual Clerk API, not proxy
     return this.originalFrontendApi === tokenIssuer;

packages/backend/src/tokens/clerkRequest.ts

@@ -94,13 +94,12 @@ class ClerkRequest extends Request {
   }
 
   private parseCookies(req: Request) {
-    const cookiesRecord = parse(this.decodeCookieValue(req.headers.get('cookie') || ''));
+    // Hand the raw header to `parse`, which splits on the RFC 6265 delimiters before
+    // percent-decoding each value. Decoding the header first would promote an encoded
+    // `;`/`=` inside one value into a delimiter, forging additional cookies.
+    const cookiesRecord = parse(req.headers.get('cookie') || '');
     return new Map(Object.entries(cookiesRecord));
   }
-
-  private decodeCookieValue(str: string) {
-    return str ? str.replace(/(%[0-9A-Z]{2})+/g, decodeURIComponent) : str;
-  }
 }
 
 export const createClerkRequest = (...args: ConstructorParameters<typeof ClerkRequest>): ClerkRequest => {