feat(clerk-js): Role change session revocation #6815
Conversation
- Automatically revoke all user sessions when role is changed - Prevents cache issues with stale permissions - Adds visual feedback during session revocation process - Ensures immediate security updates when roles change - Maintains existing error handling and UI patterns
- Removed useState import and revokingSessionsFor state - Removed visual feedback UI (Revoking sessions... indicator) - Simplified handleRoleChange function - Kept automatic session revocation functionality - Cleaner implementation without visual changes
|
|
@YektaRoustaei is attempting to deploy a commit to the Clerk Production Team on Vercel. A member of the Team first needs to authorize it. |
tmilewski
changed the title
|
@YektaRoustaei Thank you! I'm going to ping @panteliselef as it'll be better that he reviews this. |
|
@YektaRoustaei there are no |
|
This PR seems to be using methods that are non existent in our JS SDK, also the logic seems to be flawed and attempting to fix a problem that is not well defined. Feel free to open a new PR in the future. |
Description
This PR ensures that when a user’s role is updated in the dashboard, all active sessions for that user are automatically revoked.
Previously, role changes did not revoke live sessions, which caused stale permission data to remain cached in active sessions. This led to UI inconsistencies and, more critically, potential security issues — for example, a downgraded user could still retain elevated access until their session expired.
By revoking all sessions immediately upon role change:
🚫 Eliminates cache bugs caused by outdated role/permission data.
🔒 Ensures that security updates take effect instantly across all devices.
🎛️ Preserves existing error handling and UI feedback patterns, with added visual indication during the revocation process.
How to Test
Assign a role to a user.
Log in with that user on multiple devices/tabs.
Change the user’s role in the dashboard.
Verify that all existing sessions are revoked and the user is prompted to log in again.
Confirm that the new role/permissions are applied correctly after reauthentication.