chore: Improve Backend request handling #742

dimkl · 2024-02-27T15:05:41Z

This PR will be used to decide upon the nodejs related SDKs doc structure.

Files updated:
🔎 Preview /backend-requests/handling/fastify
🔎 Preview /backend-requests/handling/manual-jwt
🔎 Preview /backend-requests/overview

Co-authored-by: Alexis Aguilar <98043211+alexisintech@users.noreply.github.com> Co-authored-by: panteliselef <panteliselef@outlook.com> Co-authored-by: Lennart <lekoarts@gmail.com>

Co-authored-by: Roy Anger <roy@royanger.com>

Co-authored-by: Jacob M-G Evans <27247160+JacobMGEvans@users.noreply.github.com>

… (#636)

Co-authored-by: Lennart <lekoarts@gmail.com>

dimkl · 2024-02-27T15:05:49Z

!preview

github-actions · 2024-02-27T15:15:42Z

Hey @dimkl, your docs preview is available.

Status	Preview	Updated (UTC)
🍪 Updated	Visit preview	Feb 28, 2024 03:24 PM

alexisintech · 2024-02-28T16:42:43Z

docs/backend-requests/handling/fastify.mdx

+and is used in combination with `getAuth()` to retrieve the auth and handle appropriately the request.
+
+## Implementing lax authentication
+


What does "lax authentication" mean for users? We can add an explanation here

alexisintech · 2024-02-28T16:42:49Z

docs/backend-requests/handling/fastify.mdx

+</CodeBlockTabs>
+
+## Implementing strict authentication
+


What does "strict authentication" mean? We can add an explanation here

alexisintech · 2024-02-28T16:44:02Z

docs/backend-requests/handling/fastify.mdx

+| `secretKey` | `string` | TODO  |
+| `apiUrl` | `string` | TODO  |
+| `apiVersion` | `string` | TODO  |
+| `userAgent` | `string` | TODO  |
+| `audience` | `string \| string[]` | TODO  |
+| `publishableKey` | `string` | TODO  |
+| `isSatellite` | `boolean` | TODO  |
+| `domain` | `string` | TODO  |
+| `proxyUrl` | `string` | TODO  |
+| `sdkMetadata` | `{ name: string, version: string }` | TODO  |
+| `telemetry` | `{ disabled: boolean, debug: boolean }` | TODO  |


if this PR isn't ready for review, please revert to draft 🫶
also, I'm pretty sure we have the descriptions for these values on other pages! I'd ctrl + shift + f to search all of the clerk docs and just copy and paste the descriptions :)

i have reverted it to draft since it's not ready for review 😓
Yes, i think that I've seen most of them somewhere in our docs.

alexisintech · 2024-02-28T16:57:56Z

docs/backend-requests/handling/manual-jwt.mdx

-
-1. Use the above Public Key to verify the token's signature.
-2. Validate that the token is not expired by checking the `exp` ([Expiration time](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4)) and `nbf` ([Not before](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.5)) claims.
+1. Uses the instance Public Key to verify the token's signature (to manually find and use the public key check [here](#get-your-instances-public-key)).


so does authenticateRequest automatically have access to the user's public key?

The authenticateRequest() retrieves the jwks (containing the JWK to verify to the token signature) of the instance from BAPI using the secretKey parameter.

alexisintech · 2024-02-28T16:58:27Z

docs/backend-requests/handling/manual-jwt.mdx

-1. Use the above Public Key to verify the token's signature.
-2. Validate that the token is not expired by checking the `exp` ([Expiration time](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4)) and `nbf` ([Not before](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.5)) claims.
+1. Uses the instance Public Key to verify the token's signature (to manually find and use the public key check [here](#get-your-instances-public-key)).
+2. Validates that the token is not expired by checking the `exp` ([Expiration time](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4)) and `nbf` ([Not before](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.5)) claims.
 3. The `azp` claim in the Clerk Session JWT stands for authorized parties. If the `azp` claim exists, validate that it equals any of your known origins that are permitted to generate those tokens. This is an extra security check that we highly recommend that you do. Verifying the `azp` claim on the server side ensures that the session token is generated from the expected frontend application. For example, if you are permitting tokens retrieved from `http://localhost:3000`, then the `azp` claim should equal `http://localhost:3000`. You can also pass an array of strings like so: `['http://localhost:4003', 'https://clerk.dev']`. If the `azp` claim does not exist, then you can skip this step.


does authenticateRequest() do verify the azp claim for the user as well?

No it doesn't. We could remove this.
Since verifying that the jwt is not expired and the jwt is signed by the Clerk instance with the secretKey set in the developer server, is sufficient.

LekoArts and others added 30 commits January 11, 2024 15:28

chore: Begin v5 migration guide

4a22bcc

update exclude list

7f4db3e

feat: adds telemetry page (#496)

a10e333

Co-authored-by: Alexis Aguilar <98043211+alexisintech@users.noreply.github.com> Co-authored-by: panteliselef <panteliselef@outlook.com> Co-authored-by: Lennart <lekoarts@gmail.com>

typos

6f579cf

more additions

71d731f

eod update

2e92a4a

Update docs/references/nextjs/read-session-data.mdx

6150156

Co-authored-by: Roy Anger <roy@royanger.com>

Update docs/references/nextjs/route-handlers.mdx

4168ff4

Co-authored-by: Roy Anger <roy@royanger.com>

Update docs/references/nextjs/server-actions.mdx

0bd0ba8

Co-authored-by: Roy Anger <roy@royanger.com>

Apply suggestions from code review

38cd743

Co-authored-by: Jacob M-G Evans <27247160+JacobMGEvans@users.noreply.github.com>

fix anchor links

cae4c33

stuff

f8db887

updates

755fece

update nextjs example: add missing import; remove dupe parens

306342c

Retheme updates (#624)

36e4409

proofreading

472e892

Merge branch 'main' into release/v5

89ce9c5

Remove with clerk middleware (#634)

597b63d

v5 javascript updates (#627)

ca7a183

v5 react updates (#635)

89cc208

feat(v5-upgrade-guide): Update upgrade guide based for ClerkJS SDKs @v5…

e135c62

… (#636)

v5 updates (#619)

c6ecb44

Co-authored-by: Lennart <lekoarts@gmail.com>

improvements

026ece9

wording

33b3fd8

feat: Removal of fallback data for paginated methods (#630)

013ef10

formatting

8103efc

fix: Remove reference of MembershipRole from use-organization (#631)

ff2aadb

Remove references to createEmail function (#620)

b3a52fe

Co-authored-by: Lennart <lekoarts@gmail.com>

add pagination changes in clerk-js

f7b8722

misc updates

915591e

dimkl requested a review from nikosdouvlis February 27, 2024 15:05

dimkl self-assigned this Feb 27, 2024

dimkl requested a review from a team as a code owner February 27, 2024 15:05

LekoArts added the deploy-preview label Feb 27, 2024

chore: Fastify wip

ffca89b

dimkl force-pushed the sdk-1395-backend-requests branch from 099d2f6 to ffca89b Compare February 27, 2024 15:27

feat: Update Manual JWT verification to use @clerk/backend

207c8b8

dimkl changed the title ~~chore: Introduce Fastify docs~~ chore: Improve Backend request handling Feb 28, 2024

alexisintech reviewed Feb 28, 2024

View reviewed changes

dimkl marked this pull request as draft February 29, 2024 18:01

alexisintech force-pushed the core-2 branch 2 times, most recently from 63cda1c to 210e452 Compare March 5, 2024 17:11

alexisintech force-pushed the core-2 branch 6 times, most recently from b4cb9ea to d1e1f42 Compare March 14, 2024 19:04

alexisintech force-pushed the core-2 branch 2 times, most recently from 7ff7598 to 57f6050 Compare March 20, 2024 19:45

alexisintech force-pushed the core-2 branch 3 times, most recently from 6b94d9a to 5abdb0a Compare April 2, 2024 18:21

alexisintech force-pushed the core-2 branch 2 times, most recently from e3640db to 085a0a7 Compare April 11, 2024 16:56

alexisintech force-pushed the core-2 branch 2 times, most recently from c6268d4 to 611e596 Compare April 22, 2024 19:31

Base automatically changed from core-2 to main April 22, 2024 19:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Improve Backend request handling #742

chore: Improve Backend request handling #742

dimkl commented Feb 27, 2024 •

edited by alexisintech

dimkl commented Feb 27, 2024

github-actions bot commented Feb 27, 2024 •

edited

alexisintech Feb 28, 2024

alexisintech Feb 28, 2024

alexisintech Feb 28, 2024

dimkl Feb 29, 2024

alexisintech Feb 28, 2024

dimkl Feb 29, 2024

alexisintech Feb 28, 2024

dimkl Feb 29, 2024

		and is used in combination with `getAuth()` to retrieve the auth and handle appropriately the request.

		## Implementing lax authentication

chore: Improve Backend request handling #742

Are you sure you want to change the base?

chore: Improve Backend request handling #742

Conversation

dimkl commented Feb 27, 2024 • edited by alexisintech

dimkl commented Feb 27, 2024

github-actions bot commented Feb 27, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dimkl commented Feb 27, 2024 •

edited by alexisintech

github-actions bot commented Feb 27, 2024 •

edited