fix(expo): clear JWT from SecureStore on sign-out to prevent stale session errors#8154
fix(expo): clear JWT from SecureStore on sign-out to prevent stale session errors#8154chriscanin wants to merge 2 commits intomainfrom
Conversation
…ssion errors When signing out via native components (AuthView, UserButton), the JWT in SecureStore was not cleared. On the next sign-in attempt, the stale JWT caused 'session_exists' / 'already signed in' errors because FAPI still saw the old session. Now explicitly deletes the JWT before calling clerk.signOut() in both the ClerkProvider native auth sync and the UserButton sign-out flow.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: eb4c7c9 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@clerk/agent-toolkit
@clerk/astro
@clerk/backend
@clerk/chrome-extension
@clerk/clerk-js
@clerk/dev-cli
@clerk/expo
@clerk/expo-passkeys
@clerk/express
@clerk/fastify
@clerk/hono
@clerk/localizations
@clerk/nextjs
@clerk/nuxt
@clerk/react
@clerk/react-router
@clerk/shared
@clerk/tanstack-react-start
@clerk/testing
@clerk/ui
@clerk/upgrade
@clerk/vue
commit: |
📝 WalkthroughWalkthroughThis changeset adds JWT cleanup logic to the 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@packages/expo/src/provider/ClerkProvider.tsx`:
- Around line 258-261: Add regression tests that exercise sign-in → sign-out →
sign-in flows to ensure the JWT cleanup prevents "session_exists"/"already
signed in" errors: create tests for both sign-out paths (calling
clerkInstance.signOut and the native UserButton sign-out flow from
packages/expo/src/native/UserButton.tsx), mock SecureStore.deleteItemAsync and
CLERK_CLIENT_JWT_KEY behavior, simulate an initial sign-in storing a JWT, invoke
the sign-out flow and verify SecureStore.deleteItemAsync was called and the
token removed, then simulate a subsequent sign-in and assert no
"session_exists"/"already signed in" error occurs; use mocks for clerkInstance
methods and SecureStore so tests assert token cleanup and successful re-sign-in.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Run ID: 340a38fd-a23a-4960-ba42-4abf5dcab09d
📒 Files selected for processing (3)
.changeset/fix-clear-jwt-on-signout.mdpackages/expo/src/native/UserButton.tsxpackages/expo/src/provider/ClerkProvider.tsx
| // Clear the JWT from SecureStore before signing out to prevent | ||
| // "session_exists" / "already signed in" errors on the next sign-in attempt. | ||
| await SecureStore.deleteItemAsync(CLERK_CLIENT_JWT_KEY).catch(() => {}); | ||
| await clerkInstance.signOut(); |
There was a problem hiding this comment.
Add regression coverage for JWT cleanup sign-out flows before merge.
Line 258 changes auth-state behavior, and the PR also changes packages/expo/src/native/UserButton.tsx (Line 160), but no tests were added/updated. Please add regression tests that cover: sign-in → sign-out via both native flows → sign-in again, and assert no "session_exists" / "already signed in" failure plus token cleanup.
As per coding guidelines: "If there are no tests added or modified as part of the PR, please suggest that tests be added to cover the changes."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@packages/expo/src/provider/ClerkProvider.tsx` around lines 258 - 261, Add
regression tests that exercise sign-in → sign-out → sign-in flows to ensure the
JWT cleanup prevents "session_exists"/"already signed in" errors: create tests
for both sign-out paths (calling clerkInstance.signOut and the native UserButton
sign-out flow from packages/expo/src/native/UserButton.tsx), mock
SecureStore.deleteItemAsync and CLERK_CLIENT_JWT_KEY behavior, simulate an
initial sign-in storing a JWT, invoke the sign-out flow and verify
SecureStore.deleteItemAsync was called and the token removed, then simulate a
subsequent sign-in and assert no "session_exists"/"already signed in" error
occurs; use mocks for clerkInstance methods and SecureStore so tests assert
token cleanup and successful re-sign-in.
1 participant
Summary
Fixes "session_exists" / "already signed in" errors when users try to sign in again after signing out via native components (
<AuthView />,<UserButton />).When signing out,
clerk.signOut()clears the Clerk JS SDK state but does NOT clear the JWT stored inexpo-secure-store. On the next sign-in attempt, the stale JWT is sent with the FAPI request, causing the server to reject it with "session_exists" because it sees an active session.The fix explicitly deletes the JWT from SecureStore before calling
clerk.signOut()in both:ClerkProvider.tsx(native auth state sync for signedOut events)UserButton.tsx(sign-out after profile modal closes)Reported by
Test plan
<AuthView />, sign out, sign in again (no "already signed in" error)<UserButton />profile, sign out, sign in again (no error)🤖 Generated with Claude Code
Summary by CodeRabbit