Repository navigation
fix(expo): clear JWT from SecureStore on sign-out to prevent stale session errors - #8154
chriscanin wants to merge 2 commits into
Conversation
…ssion errors When signing out via native components (AuthView, UserButton), the JWT in SecureStore was not cleared. On the next sign-in attempt, the stale JWT caused 'session_exists' / 'already signed in' errors because FAPI still saw the old session. Now explicitly deletes the JWT before calling clerk.signOut() in both the ClerkProvider native auth sync and the UserButton sign-out flow.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: eb4c7c9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
📝 WalkthroughWalkthroughThis changeset adds JWT cleanup logic to the 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/expo/src/provider/ClerkProvider.tsx`:
- Around line 258-261: Add regression tests that exercise sign-in → sign-out →
sign-in flows to ensure the JWT cleanup prevents "session_exists"/"already
signed in" errors: create tests for both sign-out paths (calling
clerkInstance.signOut and the native UserButton sign-out flow from
packages/expo/src/native/UserButton.tsx), mock SecureStore.deleteItemAsync and
CLERK_CLIENT_JWT_KEY behavior, simulate an initial sign-in storing a JWT, invoke
the sign-out flow and verify SecureStore.deleteItemAsync was called and the
token removed, then simulate a subsequent sign-in and assert no
"session_exists"/"already signed in" error occurs; use mocks for clerkInstance
methods and SecureStore so tests assert token cleanup and successful re-sign-in.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 340a38fd-a23a-4960-ba42-4abf5dcab09d
📒 Files selected for processing (3)
.changeset/fix-clear-jwt-on-signout.mdpackages/expo/src/native/UserButton.tsxpackages/expo/src/provider/ClerkProvider.tsx
| // Clear the JWT from SecureStore before signing out to prevent | ||
| // "session_exists" / "already signed in" errors on the next sign-in attempt. | ||
| await SecureStore.deleteItemAsync(CLERK_CLIENT_JWT_KEY).catch(() => {}); | ||
| await clerkInstance.signOut(); |
There was a problem hiding this comment.
Add regression coverage for JWT cleanup sign-out flows before merge.
Line 258 changes auth-state behavior, and the PR also changes packages/expo/src/native/UserButton.tsx (Line 160), but no tests were added/updated. Please add regression tests that cover: sign-in → sign-out via both native flows → sign-in again, and assert no "session_exists" / "already signed in" failure plus token cleanup.
As per coding guidelines: "If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/expo/src/provider/ClerkProvider.tsx` around lines 258 - 261, Add
regression tests that exercise sign-in → sign-out → sign-in flows to ensure the
JWT cleanup prevents "session_exists"/"already signed in" errors: create tests
for both sign-out paths (calling clerkInstance.signOut and the native UserButton
sign-out flow from packages/expo/src/native/UserButton.tsx), mock
SecureStore.deleteItemAsync and CLERK_CLIENT_JWT_KEY behavior, simulate an
initial sign-in storing a JWT, invoke the sign-out flow and verify
SecureStore.deleteItemAsync was called and the token removed, then simulate a
subsequent sign-in and assert no "session_exists"/"already signed in" error
occurs; use mocks for clerkInstance methods and SecureStore so tests assert
token cleanup and successful re-sign-in.
|
Hello 👋 We currently close PRs after 60 days of inactivity. It's been 50 days since the last update here. If we missed this PR, please reply here. Otherwise, we'll close this PR in 10 days. Thanks for being a part of the Clerk community! 🙏 |
This branch was successfully deployed
1 participant
Summary
Fixes "session_exists" / "already signed in" errors when users try to sign in again after signing out via native components (
<AuthView />,<UserButton />).When signing out,
clerk.signOut()clears the Clerk JS SDK state but does NOT clear the JWT stored inexpo-secure-store. On the next sign-in attempt, the stale JWT is sent with the FAPI request, causing the server to reject it with "session_exists" because it sees an active session.The fix explicitly deletes the JWT from SecureStore before calling
clerk.signOut()in both:ClerkProvider.tsx(native auth state sync for signedOut events)UserButton.tsx(sign-out after profile modal closes)Reported by
Test plan
<AuthView />, sign out, sign in again (no "already signed in" error)<UserButton />profile, sign out, sign in again (no error)🤖 Generated with Claude Code
Summary by CodeRabbit