fix(backend): Avoid handshake loop on primary domain sync (#6755)

Author: brkalow

.changeset/clear-forks-ring.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Fix a case where handshakes would get triggered in a loop on cross origin requests in development.

packages/backend/src/tokens/request.ts

@@ -577,7 +577,8 @@ export const authenticateRequest: AuthenticateRequest = (async (
         !authenticateContext.isSatellite && // We're on primary
         authenticateContext.secFetchDest === 'document' && // Document navigation
         authenticateContext.isCrossOriginReferrer() && // Came from different domain
-        !authenticateContext.isKnownClerkReferrer(); // Not from Clerk accounts portal or FAPI
+        !authenticateContext.isKnownClerkReferrer() && // Not from Clerk accounts portal or FAPI
+        authenticateContext.handshakeRedirectLoopCounter === 0; // Not in a redirect loop
 
       if (shouldForceHandshakeForCrossDomain) {
         return handleMaybeHandshakeStatus(