April 2022 Summaries

Clerk has developed a Frontend API that avoids triggering CORS preflight requests by ensuring all API requests qualify as "simple requests," which do not add security for modern applications and only serve to protect legacy systems. CORS preflights were originally designed to safeguard older applications from potential risks associated with browsers sending alternative request methods and custom headers, but they result in unnecessary latency for contemporary applications. Clerk uses polyfills to handle modern request methods and custom headers without preflights, by overriding methods with query strings and handling non-sensitive headers similarly, while sensitive information like authorization tokens is included within the request body. This approach not only bypasses the preflights but also reduces the extra network round-trip time, optimizing response times crucial for modern web applications.

Debates about whether session authentication should be stateful or stateless often focus on the trade-off between security and speed. Stateful authentication, which uses a database to track active sessions, is considered more secure because it allows for instant session revocation if a threat is detected. Conversely, stateless authentication, which relies on cryptographically signed tokens like JWTs, is faster due to its minimal database interaction, offering rapid verification under 1 millisecond. To combine the advantages of both methods, a hybrid approach can be used, where stateless tokens have short expiration times and are periodically refreshed by querying the database to ensure the session remains active. This hybrid model allows for revocation within a brief timeframe, while maintaining the speed benefits of stateless authentication. Clerk has implemented this approach, setting tokens to expire every 60 seconds and refreshing them asynchronously, ensuring that the system remains both quick and secure.

Clerk is developing authentication solutions tailored for modern web applications, providing SDKs not only for various programming languages like JavaScript, Ruby, and Go but also for contemporary React frameworks such as Next.js, Redwood, Gatsby, Expo, and Remix. The focus is on making installation and usage seamless, exemplified by their preference for the getAuth(request) method in Remix, which allows for a more direct and intuitive retrieval of authentication data without the need for wrappers. Clerk appreciates the use of "splats" in Remix, which facilitate handling of sub-routes effectively, enhancing user experience by maintaining state through URL paths. Additionally, Remix's edge-by-default capability aligns with Clerk's optimization for edge-based applications, utilizing stateless authentication with JWTs to enable efficient and secure sessions without the need for geography-bound network requests. This combination of features positions Clerk to support developers in building robust and responsive authentication systems for the modern web.

Clerk's React library offers customizable components such as <SignUp/>, <SignIn/>, and <UserProfile/>, which are styled and fully-featured to help developers focus on building their applications. The company is transitioning from a "unicorn" strategy, which required developers to use Clerk's specific theming system, to a more flexible "chameleon" strategy that allows integration with various existing styling systems. This new approach enables developers to customize components using popular styling libraries like Tailwind, CSS modules, styled-components, and Chakra, by providing a theme prop that either replaces default classes, renders custom React components, or modifies styles directly. Clerk aims to ensure compatibility with diverse styling libraries by leveraging HTML and React primitives, thereby enhancing the developer experience and addressing challenges with whitelabeling software.

Clerk is advancing authentication and user management APIs by offering a system that allows developers to manage user records without relying extensively on webhooks, thus simplifying the developer experience. The traditional use of webhooks, while providing reliability and enabling data redundancy, demands significant engineering resources to implement and maintain. Clerk proposes real-time data requests as an alternative, addressing latency concerns through technologies like React for frontend data loading and edge computing to minimize latency in data authorization. This approach utilizes JSON Web Tokens (JWTs) for efficient session authentication, reducing latency and enhancing integration with third-party services. Clerk's strategies aim to streamline API integrations, anticipating a shift towards more frontend-accessible APIs that leverage JWTs, thereby fostering faster development processes and increasing developer satisfaction.