clerk deploy OAuth walkthrough lists https://www.www.<domain> for a www. domain #557

What happens

When clerk deploy walks a person through setting up a social login provider (for example Google) for production, it lists the "Authorized JavaScript origins" to register with the provider. It builds that list as https://<domain> and https://www.<domain>, without checking whether the domain already starts with www..

So a production domain of www.example.com gives:

• https://www.example.com
• https://www.www.example.com

Who hits it

Anyone who enters a production domain starting with www. in clerk deploy, then chooses the step-by-step walkthrough for a social login provider. The list is shared, so it affects every provider's walkthrough, not only Google's.

What the person experiences

They're told to register an address that doesn't exist. Registering it is harmless, but it's confusing, and a careful person may stop to work out whether they entered the domain wrong.

How big a deal it is

• How often: low. It needs a www. production domain and the walkthrough.
• How bad when it happens: low. Sign-in still works, because the correct origin is also listed.
• Does it block them: no.

Proposed fix

Add the www. variant only when the domain doesn't already start with www.. For a www. domain, consider listing the bare domain as the second origin instead.

Where it goes: oauthWalkthroughUrls in packages/cli-core/src/commands/deploy/providers.ts, and the matching line in packages/cli-core/src/commands/deploy/README.md.

Tests

• example.com gives https://example.com and https://www.example.com.
• www.example.com never gives https://www.www.example.com.

Reproduce

1. Run clerk deploy on an app with no production instance.
2. Enter www.example.com as the production domain.
3. When a social login provider is set up, choose the walkthrough.
4. The "Authorized JavaScript origins" list includes https://www.www.example.com.