diff --git a/.changeset/tanstack-start-csrf-minimum.md b/.changeset/tanstack-start-csrf-minimum.md new file mode 100644 index 00000000000..a4746ad845d --- /dev/null +++ b/.changeset/tanstack-start-csrf-minimum.md @@ -0,0 +1,22 @@ +--- +'@clerk/tanstack-react-start': minor +--- + +Raise the minimum supported peer dependencies to `@tanstack/react-start@^1.168.10` and `@tanstack/react-router@^1.170.7`. Start 1.168.10 is the first version where importing `createCsrfMiddleware()` works reliably during Vite SSR. + +TanStack Start skips its default CSRF protection for server functions when your app has a `src/start.ts`, which `clerkMiddleware()` requires. Register `createCsrfMiddleware()` before `clerkMiddleware()` to restore it: + +```ts +import { clerkMiddleware } from '@clerk/tanstack-react-start/server'; +import { createCsrfMiddleware, createStart } from '@tanstack/react-start'; + +const csrfMiddleware = createCsrfMiddleware({ + filter: (ctx) => ctx.handlerType === 'serverFn', +}); + +export const startInstance = createStart(() => { + return { + requestMiddleware: [csrfMiddleware, clerkMiddleware()], + }; +}); +``` diff --git a/packages/tanstack-react-start/README.md b/packages/tanstack-react-start/README.md index c812aa77537..f5e48ff6d1f 100644 --- a/packages/tanstack-react-start/README.md +++ b/packages/tanstack-react-start/README.md @@ -31,8 +31,8 @@ ### Prerequisites -- TanStack Start `^1.157.0` or later -- TanStack Router `^1.157.0` or later +- TanStack Start `^1.168.10` or later +- TanStack Router `^1.170.7` or later - React 18 or later - Node.js `>=20.9.0` or later - An existing Clerk application. [Create your account for free](https://dashboard.clerk.com/sign-up?utm_source=github&utm_medium=clerk_tanstack_react_start). diff --git a/packages/tanstack-react-start/package.json b/packages/tanstack-react-start/package.json index 47f9164f764..37d46b81ddd 100644 --- a/packages/tanstack-react-start/package.json +++ b/packages/tanstack-react-start/package.json @@ -90,8 +90,8 @@ "esbuild-plugin-file-path-extensions": "^2.1.4" }, "peerDependencies": { - "@tanstack/react-router": "^1.168.10", - "@tanstack/react-start": "^1.167.17", + "@tanstack/react-router": "^1.170.7", + "@tanstack/react-start": "^1.168.10", "react": "catalog:peer-react", "react-dom": "catalog:peer-react" },