refactor(backend,express): resolve relative proxyUrl in backend

When proxyUrl is a relative path (e.g. '/__clerk'), the backend now
resolves it against the request's public origin derived from
x-forwarded-* headers. This eliminates duplicated forwarded-header
parsing in SDK packages like Express, which can now pass just the
path instead of computing the full URL themselves.

Author: nikosdouvlis

packages/backend/src/tokens/authenticateContext.ts

@@ -85,6 +85,11 @@ class AuthenticateContext implements AuthenticateContext {
 
     Object.assign(this, options);
     this.clerkUrl = this.clerkRequest.clerkUrl;
+
+    // Resolve relative proxyUrl to absolute using the request's public origin.
+    if (this.proxyUrl?.startsWith('/')) {
+      this.proxyUrl = `${this.clerkUrl.origin}${this.proxyUrl}`;
+    }
   }
 
   public usesSuffixedCookies(): boolean {
@@ -250,6 +255,14 @@ class AuthenticateContext implements AuthenticateContext {
     assertValidPublishableKey(options.publishableKey);
     this.publishableKey = options.publishableKey;
 
+    // If proxyUrl is a relative path (e.g. '/__clerk'), resolve it against the
+    // request's public origin (derived from x-forwarded-* headers by ClerkRequest).
+    // This lets SDKs pass just the path instead of duplicating forwarded-header parsing.
+    let resolvedProxyUrl = options.proxyUrl;
+    if (resolvedProxyUrl?.startsWith('/')) {
+      resolvedProxyUrl = `${this.clerkRequest.clerkUrl.origin}${resolvedProxyUrl}`;
+    }
+
     const originalPk = parsePublishableKey(this.publishableKey, {
       fatal: true,
       domain: options.domain,
@@ -259,7 +272,7 @@ class AuthenticateContext implements AuthenticateContext {
 
     const pk = parsePublishableKey(this.publishableKey, {
       fatal: true,
-      proxyUrl: options.proxyUrl,
+      proxyUrl: resolvedProxyUrl,
       domain: options.domain,
       isSatellite: options.isSatellite,
     });

packages/express/src/authenticateRequest.ts

@@ -164,7 +164,8 @@ export const authenticateAndDecorateRequest = (options: ClerkMiddlewareOptions =
       }
     }
 
-    // Auto-derive proxyUrl from frontendApiProxy config if not explicitly set
+    // Pass the proxy path to authenticateRequest - the backend resolves it
+    // against the request's public origin (from x-forwarded-* headers).
     let resolvedOptions = options;
     if (frontendApiProxy && !options.proxyUrl) {
       const requestUrl = new URL(request.originalUrl || request.url, `http://${request.headers.host}`);
@@ -173,17 +174,7 @@ export const authenticateAndDecorateRequest = (options: ClerkMiddlewareOptions =
           ? frontendApiProxy.enabled(requestUrl)
           : frontendApiProxy.enabled;
       if (isProxyEnabled) {
-        const forwardedProto = request.headers['x-forwarded-proto'];
-        const protoHeader = Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto;
-        const proto = (protoHeader || '').split(',')[0].trim();
-        const protocol = request.secure || proto === 'https' ? 'https' : 'http';
-
-        const forwardedHost = request.headers['x-forwarded-host'];
-        const hostHeader = Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost;
-        const host = (hostHeader || '').split(',')[0].trim() || request.headers.host || 'localhost';
-
-        const derivedProxyUrl = `${protocol}://${host}${proxyPath}`;
-        resolvedOptions = { ...options, proxyUrl: derivedProxyUrl };
+        resolvedOptions = { ...options, proxyUrl: proxyPath };
       }
     }