Skip to content

Protect TanStack Start init middleware setup #523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SarahSoutoul merged 8 commits into from
Oct 7, 2026
Merged

Protect TanStack Start init middleware setup #523

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
ec24ad5
fix: protect TanStack Start init middleware setup
SarahSoutoul Oct 6, 2026
581c841
fix(init): list a manual step when start.ts can't take Clerk middleware
manovotny Oct 7, 2026
f60131d
fix(init): name the CSRF filter parameter ctx
manovotny Oct 7, 2026
0a85d99
fix(init): add CSRF to existing TanStack Start setups
SarahSoutoul Oct 7, 2026
7c7fb62
fix(init): require Start 1.168.10 for CSRF and keep start.ts formatting
manovotny Oct 7, 2026
9c7c9cb
fix(init): match the import source without building a regex
manovotny Oct 7, 2026
19fa5ea
fix(init): recognize variable-held Clerk middleware
SarahSoutoul Oct 7, 2026
9fc43c2
fix(init): recognize aliased and shadowed Clerk middleware bindings
manovotny Oct 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/tanstack-start-csrf.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"clerk": patch
---

Register TanStack Start's CSRF middleware before Clerk's middleware in `src/start.ts`, both when `clerk init` creates the file and when it can safely edit an existing one. This needs `@tanstack/react-start` 1.168.10 or later; otherwise `clerk init` prints the manual steps instead.
14 changes: 8 additions & 6 deletions packages/cli-core/src/commands/init/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,12 +169,14 @@ Nuxt's module system auto-configures middleware and auto-imports components.

### TanStack Start

| Action | File | Description |
| ------ | -------------------------- | ------------------------------------------- |
| MODIFY | `src/start.ts` | Add `clerkMiddleware` to request middleware |
| MODIFY | `src/routes/__root.tsx` | Add `ClerkProvider` and wrap body contents |
| CREATE | `src/routes/sign-in.$.tsx` | Sign-in route with `<SignIn />` component |
| CREATE | `src/routes/sign-up.$.tsx` | Sign-up route with `<SignUp />` component |
| Action | File | Description |
| ------------- | -------------------------- | ----------------------------------------------- |
| CREATE/MODIFY | `src/start.ts` | Register CSRF middleware, then Clerk middleware |
| MODIFY | `src/routes/__root.tsx` | Add `ClerkProvider` and wrap body contents |
| CREATE | `src/routes/sign-in.$.tsx` | Sign-in route with `<SignIn />` component |
| CREATE | `src/routes/sign-up.$.tsx` | Sign-up route with `<SignUp />` component |

CSRF middleware needs `@tanstack/react-start` 1.168.10 or later, with `@tanstack/react-router` 1.170.7 or later. When the version is older or can't be confirmed, or an existing `start.ts` can't be edited safely, `clerk init` leaves the file unchanged and prints the manual steps.

### Astro

Expand Down
Loading
Loading