remix-auth-starter

remix-auth-starter copied to clipboard

The signin & signout pages in this starter don't have x-frame-options headers, nor does the root loader, so it looks like anyone who follows this as their starter will start off with a clickjacking vulnerability.

Ping - any update here? A little concerned that Clerk-starter projects are insecure by default.

Hello @tmcw! Thank you for pointing this out! We applied a fix in our up-to-date starter here: https://github.com/clerk/clerk-remix-v2