Clerk's use of localStorage is not safe enough

[tmcw]

Preliminary Checks

• I have reviewed the documentation: https://clerk.com/docs

• I have searched for existing issues: https://github.com/clerk/javascript/issues

• I have not already reached out to Clerk support via email or Discord (if you have, no need to open an issue here)

• This issue is not a question, general help request, or anything other than a bug report directly related to Clerk. Please ask questions in our Discord community: https://clerk.com/discord.

Reproduction

http://val.town/

Publishable key

pk_test_aHVtb3JvdXMtZGFzc2llLTE4LmNsZXJrLmFjY291bnRzLmRldiQ

Description

Steps to reproduce:

1. Use Firefox in Private mode, or Android in private mode, or a page that uses Clerk in an iframe with locked-down sandbox permissions

Expected behavior:

Clerk is safe in its usage of localStorage APIs.

Actual behavior:

It isn't, it calls localStorage.getItem and produces an uncaught error.

---

There is a previous issue about this in the context of expo: #1620

But this isn't safe enough. It's pretty clear from history that localStorage is an 'exploding API' when used in paranoid browser environments: the window exists, maybe localStorage exists, and the method localStorage.getItem exists, but if you call localStorage.getItem() it'll throw an error. Examples from prod:

SecurityError: Failed to read the 'localStorage' property from 'Window': Access is denied for this document.

This can also happen if someone has Firefox with dom.storage.enabled turned off, and many folks do.

See previous discussion here: https://mathiasbynens.be/notes/localstorage-pattern#comment-9 - basically any operations on localstorage should be expected to throw errors in locked-down browser environments.

Environment

System:
    OS: macOS 15.2
    CPU: (8) arm64 Apple M2
    Memory: 104.34 MB / 24.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 22.11.0 - ~/.local/share/mise/installs/node/22.11.0/bin/node
    npm: 10.9.0 - ~/.local/share/mise/installs/node/22.11.0/bin/npm
    bun: 1.0.28 - ~/.bun/bin/bun
    Watchman: 2024.12.02.00 - /opt/homebrew/bin/watchman
  Browsers:
    Chrome: 132.0.6834.110
    Chrome Canary: 134.0.6982.0
    Edge: 132.0.2957.127
    Safari: 18.2
  npmPackages:

[mateussmohamed]

same issue