fix(backend): stop authenticateRequest from consuming the request body

.changeset/clerkrequest-omit-body.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Stop `authenticateRequest` from consuming the incoming request body, which previously left downstream handlers unable to read it (for example a Hono POST route calling `c.req.json()`).

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -2,6 +2,21 @@ import { describe, expect, it } from 'vitest';
 
 import { createClerkRequest } from '../clerkRequest';
 
+// Some test runtimes (e.g. Cloudflare/miniflare) gate `new ReadableStream()`
+// behind a feature flag and throw when it is constructed directly.
+const supportsStreamConstruction = (() => {
+ try {
+ new ReadableStream({
+ start(controller) {
+ controller.close();
+ },
+ });
+ return true;
+ } catch {
+ return false;
+ }
+})();
+
 describe('createClerkRequest', () => {
  describe('instantiating a request', () => {
  it('retains the headers', () => {
@@ -17,11 +32,34 @@ describe('createClerkRequest', () => {
  expect(req.method).toBe(oldReq.method);
  });
 
- it('retains the body', async () => {
- const data = { a: '1' };
- const oldReq = new Request('http://localhost:3000', { method: 'POST', body: JSON.stringify(data) });
+ // The hazard only exists on undici-style runtimes (Node, edge) where the
+ // request body is a single-use stream. Cloudflare/miniflare buffers bodies
+ // (so the body survives anyway) and cannot construct a streaming body, so
+ // this regression is skipped there.
+ it.skipIf(!supportsStreamConstruction)('does not consume the original request body (issue #8305)', async () => {
+ // Clerk only needs the method, headers, cookies, and URL. Forwarding the
+ // body made the clone share the original's single-use stream, so reading
+ // either side left the other "unusable" for downstream handlers (e.g. a
+ // Hono POST route calling `c.req.json()`).
+ const stream = new ReadableStream({
+ start(controller) {
+ controller.enqueue(new TextEncoder().encode(JSON.stringify({ a: '1' })));
+ controller.close();
+ },
+ });
+ const oldReq = new Request('http://localhost:3000', {
+ method: 'POST',
+ body: stream,
+ // `duplex` is required when streaming a body; not yet in all lib typings.
+ duplex: 'half',
+ } as RequestInit);
+
  const req = createClerkRequest(oldReq);
- expect((await req.json())['a']).toBe(data.a);
+
+ // The clone carries no body, so it can never lock the original's stream...
+ expect(req.body).toBeNull();
+ // ...and the original stream stays readable for downstream consumers.
+ expect(((await oldReq.json()) as { a: string }).a).toBe('1');
  });
 
  it('retains the url', () => {

packages/backend/src/tokens/clerkRequest.ts

@@ -26,18 +26,22 @@ class ClerkRequest extends Request {
  // https://github.com/nodejs/undici/issues/2155
  // https://github.com/nodejs/undici/blob/7153a1c78d51840bbe16576ce353e481c3934701/lib/fetch/request.js#L854
  const url = typeof input !== 'string' && 'url' in input ? input.url : String(input);
- // When cloning a Request by passing it as init, hide its `signal`. Undici's
- // Request constructor in Node 24 performs a strict instanceof check on the
- // signal and rejects ones from a different realm (e.g. NextRequest). Using a
- // Proxy keeps property access lazy so environments that don't implement
- // optional getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
+ // When cloning a Request by passing it as init, hide its `signal` and `body`.
+ // Undici's Request constructor in Node 24 performs a strict instanceof check on
+ // the signal and rejects ones from a different realm (e.g. NextRequest). The
+ // `body` is hidden because forwarding it makes the clone share the original's
+ // single-use ReadableStream; once either side is read the other throws
+ // "Body is unusable" downstream (issue #8305). Auth only reads the method,
+ // headers, cookies, and URL, so the clone never needs a body. Using a Proxy
+ // keeps property access lazy so environments that don't implement optional
+ // getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
  let cloneInit: RequestInit | undefined;
  if (init) {
  cloneInit = init;
  } else if (typeof input !== 'string') {
  cloneInit = new Proxy(input as Request, {
  get(target, prop) {
- if (prop === 'signal') {
+ if (prop === 'signal' || prop === 'body') {
  return undefined;
  }
  return Reflect.get(target, prop, target);

.changeset/clerkrequest-omit-body.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Stop `authenticateRequest` from consuming the incoming request body, which previously left downstream handlers unable to read it (for example a Hono POST route calling `c.req.json()`).

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -2,6 +2,21 @@ import { describe, expect, it } from 'vitest';
 
 import { createClerkRequest } from '../clerkRequest';
 
+// Some test runtimes (e.g. Cloudflare/miniflare) gate `new ReadableStream()`
+// behind a feature flag and throw when it is constructed directly.
+const supportsStreamConstruction = (() => {
+ try {
+ new ReadableStream({
+ start(controller) {
+ controller.close();
+ },
+ });
+ return true;
+ } catch {
+ return false;
+ }
+})();
+
 describe('createClerkRequest', () => {
  describe('instantiating a request', () => {
  it('retains the headers', () => {
@@ -17,11 +32,34 @@ describe('createClerkRequest', () => {
  expect(req.method).toBe(oldReq.method);
  });
 
- it('retains the body', async () => {
- const data = { a: '1' };
- const oldReq = new Request('http://localhost:3000', { method: 'POST', body: JSON.stringify(data) });
+ // The hazard only exists on undici-style runtimes (Node, edge) where the
+ // request body is a single-use stream. Cloudflare/miniflare buffers bodies
+ // (so the body survives anyway) and cannot construct a streaming body, so
+ // this regression is skipped there.
+ it.skipIf(!supportsStreamConstruction)('does not consume the original request body (issue #8305)', async () => {
+ // Clerk only needs the method, headers, cookies, and URL. Forwarding the
+ // body made the clone share the original's single-use stream, so reading
+ // either side left the other "unusable" for downstream handlers (e.g. a
+ // Hono POST route calling `c.req.json()`).
+ const stream = new ReadableStream({
+ start(controller) {
+ controller.enqueue(new TextEncoder().encode(JSON.stringify({ a: '1' })));
+ controller.close();
+ },
+ });
+ const oldReq = new Request('http://localhost:3000', {
+ method: 'POST',
+ body: stream,
+ // `duplex` is required when streaming a body; not yet in all lib typings.
+ duplex: 'half',
+ } as RequestInit);
+
  const req = createClerkRequest(oldReq);
- expect((await req.json())['a']).toBe(data.a);
+
+ // The clone carries no body, so it can never lock the original's stream...
+ expect(req.body).toBeNull();
+ // ...and the original stream stays readable for downstream consumers.
+ expect(((await oldReq.json()) as { a: string }).a).toBe('1');
  });
 
  it('retains the url', () => {

packages/backend/src/tokens/clerkRequest.ts

@@ -26,18 +26,22 @@ class ClerkRequest extends Request {
  // https://github.com/nodejs/undici/issues/2155
  // https://github.com/nodejs/undici/blob/7153a1c78d51840bbe16576ce353e481c3934701/lib/fetch/request.js#L854
  const url = typeof input !== 'string' && 'url' in input ? input.url : String(input);
- // When cloning a Request by passing it as init, hide its `signal`. Undici's
- // Request constructor in Node 24 performs a strict instanceof check on the
- // signal and rejects ones from a different realm (e.g. NextRequest). Using a
- // Proxy keeps property access lazy so environments that don't implement
- // optional getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
+ // When cloning a Request by passing it as init, hide its `signal` and `body`.
+ // Undici's Request constructor in Node 24 performs a strict instanceof check on
+ // the signal and rejects ones from a different realm (e.g. NextRequest). The
+ // `body` is hidden because forwarding it makes the clone share the original's
+ // single-use ReadableStream; once either side is read the other throws
+ // "Body is unusable" downstream (issue #8305). Auth only reads the method,
+ // headers, cookies, and URL, so the clone never needs a body. Using a Proxy
+ // keeps property access lazy so environments that don't implement optional
+ // getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
  let cloneInit: RequestInit | undefined;
  if (init) {
  cloneInit = init;
  } else if (typeof input !== 'string') {
  cloneInit = new Proxy(input as Request, {
  get(target, prop) {
- if (prop === 'signal') {
+ if (prop === 'signal' || prop === 'body') {
  return undefined;
  }
  return Reflect.get(target, prop, target);

.changeset/clerkrequest-omit-body.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Stop `authenticateRequest` from consuming the incoming request body, which previously left downstream handlers unable to read it (for example a Hono POST route calling `c.req.json()`).

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -2,6 +2,21 @@ import { describe, expect, it } from 'vitest';
 
 import { createClerkRequest } from '../clerkRequest';
 
+// Some test runtimes (e.g. Cloudflare/miniflare) gate `new ReadableStream()`
+// behind a feature flag and throw when it is constructed directly.
+const supportsStreamConstruction = (() => {
+ try {
+ new ReadableStream({
+ start(controller) {
+ controller.close();
+ },
+ });
+ return true;
+ } catch {
+ return false;
+ }
+})();
+
 describe('createClerkRequest', () => {
  describe('instantiating a request', () => {
  it('retains the headers', () => {
@@ -17,11 +32,34 @@ describe('createClerkRequest', () => {
  expect(req.method).toBe(oldReq.method);
  });
 
- it('retains the body', async () => {
- const data = { a: '1' };
- const oldReq = new Request('http://localhost:3000', { method: 'POST', body: JSON.stringify(data) });
+ // The hazard only exists on undici-style runtimes (Node, edge) where the
+ // request body is a single-use stream. Cloudflare/miniflare buffers bodies
+ // (so the body survives anyway) and cannot construct a streaming body, so
+ // this regression is skipped there.
+ it.skipIf(!supportsStreamConstruction)('does not consume the original request body (issue #8305)', async () => {
+ // Clerk only needs the method, headers, cookies, and URL. Forwarding the
+ // body made the clone share the original's single-use stream, so reading
+ // either side left the other "unusable" for downstream handlers (e.g. a
+ // Hono POST route calling `c.req.json()`).
+ const stream = new ReadableStream({
+ start(controller) {
+ controller.enqueue(new TextEncoder().encode(JSON.stringify({ a: '1' })));
+ controller.close();
+ },
+ });
+ const oldReq = new Request('http://localhost:3000', {
+ method: 'POST',
+ body: stream,
+ // `duplex` is required when streaming a body; not yet in all lib typings.
+ duplex: 'half',
+ } as RequestInit);
+
  const req = createClerkRequest(oldReq);
- expect((await req.json())['a']).toBe(data.a);
+
+ // The clone carries no body, so it can never lock the original's stream...
+ expect(req.body).toBeNull();
+ // ...and the original stream stays readable for downstream consumers.
+ expect(((await oldReq.json()) as { a: string }).a).toBe('1');
  });
 
  it('retains the url', () => {

packages/backend/src/tokens/clerkRequest.ts

@@ -26,18 +26,22 @@ class ClerkRequest extends Request {
  // https://github.com/nodejs/undici/issues/2155
  // https://github.com/nodejs/undici/blob/7153a1c78d51840bbe16576ce353e481c3934701/lib/fetch/request.js#L854
  const url = typeof input !== 'string' && 'url' in input ? input.url : String(input);
- // When cloning a Request by passing it as init, hide its `signal`. Undici's
- // Request constructor in Node 24 performs a strict instanceof check on the
- // signal and rejects ones from a different realm (e.g. NextRequest). Using a
- // Proxy keeps property access lazy so environments that don't implement
- // optional getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
+ // When cloning a Request by passing it as init, hide its `signal` and `body`.
+ // Undici's Request constructor in Node 24 performs a strict instanceof check on
+ // the signal and rejects ones from a different realm (e.g. NextRequest). The
+ // `body` is hidden because forwarding it makes the clone share the original's
+ // single-use ReadableStream; once either side is read the other throws
+ // "Body is unusable" downstream (issue #8305). Auth only reads the method,
+ // headers, cookies, and URL, so the clone never needs a body. Using a Proxy
+ // keeps property access lazy so environments that don't implement optional
+ // getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
  let cloneInit: RequestInit | undefined;
  if (init) {
  cloneInit = init;
  } else if (typeof input !== 'string') {
  cloneInit = new Proxy(input as Request, {
  get(target, prop) {
- if (prop === 'signal') {
+ if (prop === 'signal' || prop === 'body') {
  return undefined;
  }
  return Reflect.get(target, prop, target);

.changeset/clerkrequest-omit-body.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Stop `authenticateRequest` from consuming the incoming request body, which previously left downstream handlers unable to read it (for example a Hono POST route calling `c.req.json()`).

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -2,6 +2,21 @@ import { describe, expect, it } from 'vitest';
 
 import { createClerkRequest } from '../clerkRequest';
 
+// Some test runtimes (e.g. Cloudflare/miniflare) gate `new ReadableStream()`
+// behind a feature flag and throw when it is constructed directly.
+const supportsStreamConstruction = (() => {
+ try {
+ new ReadableStream({
+ start(controller) {
+ controller.close();
+ },
+ });
+ return true;
+ } catch {
+ return false;
+ }
+})();
+
 describe('createClerkRequest', () => {
  describe('instantiating a request', () => {
  it('retains the headers', () => {
@@ -17,11 +32,34 @@ describe('createClerkRequest', () => {
  expect(req.method).toBe(oldReq.method);
  });
 
- it('retains the body', async () => {
- const data = { a: '1' };
- const oldReq = new Request('http://localhost:3000', { method: 'POST', body: JSON.stringify(data) });
+ // The hazard only exists on undici-style runtimes (Node, edge) where the
+ // request body is a single-use stream. Cloudflare/miniflare buffers bodies
+ // (so the body survives anyway) and cannot construct a streaming body, so
+ // this regression is skipped there.
+ it.skipIf(!supportsStreamConstruction)('does not consume the original request body (issue #8305)', async () => {
+ // Clerk only needs the method, headers, cookies, and URL. Forwarding the
+ // body made the clone share the original's single-use stream, so reading
+ // either side left the other "unusable" for downstream handlers (e.g. a
+ // Hono POST route calling `c.req.json()`).
+ const stream = new ReadableStream({
+ start(controller) {
+ controller.enqueue(new TextEncoder().encode(JSON.stringify({ a: '1' })));
+ controller.close();
+ },
+ });
+ const oldReq = new Request('http://localhost:3000', {
+ method: 'POST',
+ body: stream,
+ // `duplex` is required when streaming a body; not yet in all lib typings.
+ duplex: 'half',
+ } as RequestInit);
+
  const req = createClerkRequest(oldReq);
- expect((await req.json())['a']).toBe(data.a);
+
+ // The clone carries no body, so it can never lock the original's stream...
+ expect(req.body).toBeNull();
+ // ...and the original stream stays readable for downstream consumers.
+ expect(((await oldReq.json()) as { a: string }).a).toBe('1');
  });
 
  it('retains the url', () => {

packages/backend/src/tokens/clerkRequest.ts

@@ -26,18 +26,22 @@ class ClerkRequest extends Request {
  // https://github.com/nodejs/undici/issues/2155
  // https://github.com/nodejs/undici/blob/7153a1c78d51840bbe16576ce353e481c3934701/lib/fetch/request.js#L854
  const url = typeof input !== 'string' && 'url' in input ? input.url : String(input);
- // When cloning a Request by passing it as init, hide its `signal`. Undici's
- // Request constructor in Node 24 performs a strict instanceof check on the
- // signal and rejects ones from a different realm (e.g. NextRequest). Using a
- // Proxy keeps property access lazy so environments that don't implement
- // optional getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
+ // When cloning a Request by passing it as init, hide its `signal` and `body`.
+ // Undici's Request constructor in Node 24 performs a strict instanceof check on
+ // the signal and rejects ones from a different realm (e.g. NextRequest). The
+ // `body` is hidden because forwarding it makes the clone share the original's
+ // single-use ReadableStream; once either side is read the other throws
+ // "Body is unusable" downstream (issue #8305). Auth only reads the method,
+ // headers, cookies, and URL, so the clone never needs a body. Using a Proxy
+ // keeps property access lazy so environments that don't implement optional
+ // getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
  let cloneInit: RequestInit | undefined;
  if (init) {
  cloneInit = init;
  } else if (typeof input !== 'string') {
  cloneInit = new Proxy(input as Request, {
  get(target, prop) {
- if (prop === 'signal') {
+ if (prop === 'signal' || prop === 'body') {
  return undefined;
  }
  return Reflect.get(target, prop, target);

.changeset/clerkrequest-omit-body.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Stop `authenticateRequest` from consuming the incoming request body, which previously left downstream handlers unable to read it (for example a Hono POST route calling `c.req.json()`).

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -2,6 +2,21 @@ import { describe, expect, it } from 'vitest';
 
 import { createClerkRequest } from '../clerkRequest';
 
+// Some test runtimes (e.g. Cloudflare/miniflare) gate `new ReadableStream()`
+// behind a feature flag and throw when it is constructed directly.
+const supportsStreamConstruction = (() => {
+ try {
+ new ReadableStream({
+ start(controller) {
+ controller.close();
+ },
+ });
+ return true;
+ } catch {
+ return false;
+ }
+})();
+
 describe('createClerkRequest', () => {
  describe('instantiating a request', () => {
  it('retains the headers', () => {
@@ -17,11 +32,34 @@ describe('createClerkRequest', () => {
  expect(req.method).toBe(oldReq.method);
  });
 
- it('retains the body', async () => {
- const data = { a: '1' };
- const oldReq = new Request('http://localhost:3000', { method: 'POST', body: JSON.stringify(data) });
+ // The hazard only exists on undici-style runtimes (Node, edge) where the
+ // request body is a single-use stream. Cloudflare/miniflare buffers bodies
+ // (so the body survives anyway) and cannot construct a streaming body, so
+ // this regression is skipped there.
+ it.skipIf(!supportsStreamConstruction)('does not consume the original request body (issue #8305)', async () => {
+ // Clerk only needs the method, headers, cookies, and URL. Forwarding the
+ // body made the clone share the original's single-use stream, so reading
+ // either side left the other "unusable" for downstream handlers (e.g. a
+ // Hono POST route calling `c.req.json()`).
+ const stream = new ReadableStream({
+ start(controller) {
+ controller.enqueue(new TextEncoder().encode(JSON.stringify({ a: '1' })));
+ controller.close();
+ },
+ });
+ const oldReq = new Request('http://localhost:3000', {
+ method: 'POST',
+ body: stream,
+ // `duplex` is required when streaming a body; not yet in all lib typings.
+ duplex: 'half',
+ } as RequestInit);
+
  const req = createClerkRequest(oldReq);
- expect((await req.json())['a']).toBe(data.a);
+
+ // The clone carries no body, so it can never lock the original's stream...
+ expect(req.body).toBeNull();
+ // ...and the original stream stays readable for downstream consumers.
+ expect(((await oldReq.json()) as { a: string }).a).toBe('1');
  });
 
  it('retains the url', () => {

packages/backend/src/tokens/clerkRequest.ts

@@ -26,18 +26,22 @@ class ClerkRequest extends Request {
  // https://github.com/nodejs/undici/issues/2155
  // https://github.com/nodejs/undici/blob/7153a1c78d51840bbe16576ce353e481c3934701/lib/fetch/request.js#L854
  const url = typeof input !== 'string' && 'url' in input ? input.url : String(input);
- // When cloning a Request by passing it as init, hide its `signal`. Undici's
- // Request constructor in Node 24 performs a strict instanceof check on the
- // signal and rejects ones from a different realm (e.g. NextRequest). Using a
- // Proxy keeps property access lazy so environments that don't implement
- // optional getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
+ // When cloning a Request by passing it as init, hide its `signal` and `body`.
+ // Undici's Request constructor in Node 24 performs a strict instanceof check on
+ // the signal and rejects ones from a different realm (e.g. NextRequest). The
+ // `body` is hidden because forwarding it makes the clone share the original's
+ // single-use ReadableStream; once either side is read the other throws
+ // "Body is unusable" downstream (issue #8305). Auth only reads the method,
+ // headers, cookies, and URL, so the clone never needs a body. Using a Proxy
+ // keeps property access lazy so environments that don't implement optional
+ // getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
  let cloneInit: RequestInit | undefined;
  if (init) {
  cloneInit = init;
  } else if (typeof input !== 'string') {
  cloneInit = new Proxy(input as Request, {
  get(target, prop) {
- if (prop === 'signal') {
+ if (prop === 'signal' || prop === 'body') {
  return undefined;
  }
  return Reflect.get(target, prop, target);

.changeset/clerkrequest-omit-body.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Stop `authenticateRequest` from consuming the incoming request body, which previously left downstream handlers unable to read it (for example a Hono POST route calling `c.req.json()`).

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -2,6 +2,21 @@ import { describe, expect, it } from 'vitest';
 
 import { createClerkRequest } from '../clerkRequest';
 
+// Some test runtimes (e.g. Cloudflare/miniflare) gate `new ReadableStream()`
+// behind a feature flag and throw when it is constructed directly.
+const supportsStreamConstruction = (() => {
+ try {
+ new ReadableStream({
+ start(controller) {
+ controller.close();
+ },
+ });
+ return true;
+ } catch {
+ return false;
+ }
+})();
+
 describe('createClerkRequest', () => {
  describe('instantiating a request', () => {
  it('retains the headers', () => {
@@ -17,11 +32,34 @@ describe('createClerkRequest', () => {
  expect(req.method).toBe(oldReq.method);
  });
 
- it('retains the body', async () => {
- const data = { a: '1' };
- const oldReq = new Request('http://localhost:3000', { method: 'POST', body: JSON.stringify(data) });
+ // The hazard only exists on undici-style runtimes (Node, edge) where the
+ // request body is a single-use stream. Cloudflare/miniflare buffers bodies
+ // (so the body survives anyway) and cannot construct a streaming body, so
+ // this regression is skipped there.
+ it.skipIf(!supportsStreamConstruction)('does not consume the original request body (issue #8305)', async () => {
+ // Clerk only needs the method, headers, cookies, and URL. Forwarding the
+ // body made the clone share the original's single-use stream, so reading
+ // either side left the other "unusable" for downstream handlers (e.g. a
+ // Hono POST route calling `c.req.json()`).
+ const stream = new ReadableStream({
+ start(controller) {
+ controller.enqueue(new TextEncoder().encode(JSON.stringify({ a: '1' })));
+ controller.close();
+ },
+ });
+ const oldReq = new Request('http://localhost:3000', {
+ method: 'POST',
+ body: stream,
+ // `duplex` is required when streaming a body; not yet in all lib typings.
+ duplex: 'half',
+ } as RequestInit);
+
  const req = createClerkRequest(oldReq);
- expect((await req.json())['a']).toBe(data.a);
+
+ // The clone carries no body, so it can never lock the original's stream...
+ expect(req.body).toBeNull();
+ // ...and the original stream stays readable for downstream consumers.
+ expect(((await oldReq.json()) as { a: string }).a).toBe('1');
  });
 
  it('retains the url', () => {

packages/backend/src/tokens/clerkRequest.ts

@@ -26,18 +26,22 @@ class ClerkRequest extends Request {
  // https://github.com/nodejs/undici/issues/2155
  // https://github.com/nodejs/undici/blob/7153a1c78d51840bbe16576ce353e481c3934701/lib/fetch/request.js#L854
  const url = typeof input !== 'string' && 'url' in input ? input.url : String(input);
- // When cloning a Request by passing it as init, hide its `signal`. Undici's
- // Request constructor in Node 24 performs a strict instanceof check on the
- // signal and rejects ones from a different realm (e.g. NextRequest). Using a
- // Proxy keeps property access lazy so environments that don't implement
- // optional getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
+ // When cloning a Request by passing it as init, hide its `signal` and `body`.
+ // Undici's Request constructor in Node 24 performs a strict instanceof check on
+ // the signal and rejects ones from a different realm (e.g. NextRequest). The
+ // `body` is hidden because forwarding it makes the clone share the original's
+ // single-use ReadableStream; once either side is read the other throws
+ // "Body is unusable" downstream (issue #8305). Auth only reads the method,
+ // headers, cookies, and URL, so the clone never needs a body. Using a Proxy
+ // keeps property access lazy so environments that don't implement optional
+ // getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
  let cloneInit: RequestInit | undefined;
  if (init) {
  cloneInit = init;
  } else if (typeof input !== 'string') {
  cloneInit = new Proxy(input as Request, {
  get(target, prop) {
- if (prop === 'signal') {
+ if (prop === 'signal' || prop === 'body') {
  return undefined;
  }
  return Reflect.get(target, prop, target);

.changeset/clerkrequest-omit-body.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Stop `authenticateRequest` from consuming the incoming request body, which previously left downstream handlers unable to read it (for example a Hono POST route calling `c.req.json()`).

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -2,6 +2,21 @@ import { describe, expect, it } from 'vitest';
 
 import { createClerkRequest } from '../clerkRequest';
 
+// Some test runtimes (e.g. Cloudflare/miniflare) gate `new ReadableStream()`
+// behind a feature flag and throw when it is constructed directly.
+const supportsStreamConstruction = (() => {
+ try {
+ new ReadableStream({
+ start(controller) {
+ controller.close();
+ },
+ });
+ return true;
+ } catch {
+ return false;
+ }
+})();
+
 describe('createClerkRequest', () => {
  describe('instantiating a request', () => {
  it('retains the headers', () => {
@@ -17,11 +32,34 @@ describe('createClerkRequest', () => {
  expect(req.method).toBe(oldReq.method);
  });
 
- it('retains the body', async () => {
- const data = { a: '1' };
- const oldReq = new Request('http://localhost:3000', { method: 'POST', body: JSON.stringify(data) });
+ // The hazard only exists on undici-style runtimes (Node, edge) where the
+ // request body is a single-use stream. Cloudflare/miniflare buffers bodies
+ // (so the body survives anyway) and cannot construct a streaming body, so
+ // this regression is skipped there.
+ it.skipIf(!supportsStreamConstruction)('does not consume the original request body (issue #8305)', async () => {
+ // Clerk only needs the method, headers, cookies, and URL. Forwarding the
+ // body made the clone share the original's single-use stream, so reading
+ // either side left the other "unusable" for downstream handlers (e.g. a
+ // Hono POST route calling `c.req.json()`).
+ const stream = new ReadableStream({
+ start(controller) {
+ controller.enqueue(new TextEncoder().encode(JSON.stringify({ a: '1' })));
+ controller.close();
+ },
+ });
+ const oldReq = new Request('http://localhost:3000', {
+ method: 'POST',
+ body: stream,
+ // `duplex` is required when streaming a body; not yet in all lib typings.
+ duplex: 'half',
+ } as RequestInit);
+
  const req = createClerkRequest(oldReq);
- expect((await req.json())['a']).toBe(data.a);
+
+ // The clone carries no body, so it can never lock the original's stream...
+ expect(req.body).toBeNull();
+ // ...and the original stream stays readable for downstream consumers.
+ expect(((await oldReq.json()) as { a: string }).a).toBe('1');
  });
 
  it('retains the url', () => {

packages/backend/src/tokens/clerkRequest.ts

@@ -26,18 +26,22 @@ class ClerkRequest extends Request {
  // https://github.com/nodejs/undici/issues/2155
  // https://github.com/nodejs/undici/blob/7153a1c78d51840bbe16576ce353e481c3934701/lib/fetch/request.js#L854
  const url = typeof input !== 'string' && 'url' in input ? input.url : String(input);
- // When cloning a Request by passing it as init, hide its `signal`. Undici's
- // Request constructor in Node 24 performs a strict instanceof check on the
- // signal and rejects ones from a different realm (e.g. NextRequest). Using a
- // Proxy keeps property access lazy so environments that don't implement
- // optional getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
+ // When cloning a Request by passing it as init, hide its `signal` and `body`.
+ // Undici's Request constructor in Node 24 performs a strict instanceof check on
+ // the signal and rejects ones from a different realm (e.g. NextRequest). The
+ // `body` is hidden because forwarding it makes the clone share the original's
+ // single-use ReadableStream; once either side is read the other throws
+ // "Body is unusable" downstream (issue #8305). Auth only reads the method,
+ // headers, cookies, and URL, so the clone never needs a body. Using a Proxy
+ // keeps property access lazy so environments that don't implement optional
+ // getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
  let cloneInit: RequestInit | undefined;
  if (init) {
  cloneInit = init;
  } else if (typeof input !== 'string') {
  cloneInit = new Proxy(input as Request, {
  get(target, prop) {
- if (prop === 'signal') {
+ if (prop === 'signal' || prop === 'body') {
  return undefined;
  }
  return Reflect.get(target, prop, target);

.changeset/clerkrequest-omit-body.md

@@ -0,0 +1,5 @@
+---
+'@clerk/backend': patch
+---
+
+Stop `authenticateRequest` from consuming the incoming request body, which previously left downstream handlers unable to read it (for example a Hono POST route calling `c.req.json()`).

packages/backend/src/tokens/__tests__/clerkRequest.test.ts

@@ -2,6 +2,21 @@ import { describe, expect, it } from 'vitest';
 
 import { createClerkRequest } from '../clerkRequest';
 
+// Some test runtimes (e.g. Cloudflare/miniflare) gate `new ReadableStream()`
+// behind a feature flag and throw when it is constructed directly.
+const supportsStreamConstruction = (() => {
+ try {
+ new ReadableStream({
+ start(controller) {
+ controller.close();
+ },
+ });
+ return true;
+ } catch {
+ return false;
+ }
+})();
+
 describe('createClerkRequest', () => {
  describe('instantiating a request', () => {
  it('retains the headers', () => {
@@ -17,11 +32,34 @@ describe('createClerkRequest', () => {
  expect(req.method).toBe(oldReq.method);
  });
 
- it('retains the body', async () => {
- const data = { a: '1' };
- const oldReq = new Request('http://localhost:3000', { method: 'POST', body: JSON.stringify(data) });
+ // The hazard only exists on undici-style runtimes (Node, edge) where the
+ // request body is a single-use stream. Cloudflare/miniflare buffers bodies
+ // (so the body survives anyway) and cannot construct a streaming body, so
+ // this regression is skipped there.
+ it.skipIf(!supportsStreamConstruction)('does not consume the original request body (issue #8305)', async () => {
+ // Clerk only needs the method, headers, cookies, and URL. Forwarding the
+ // body made the clone share the original's single-use stream, so reading
+ // either side left the other "unusable" for downstream handlers (e.g. a
+ // Hono POST route calling `c.req.json()`).
+ const stream = new ReadableStream({
+ start(controller) {
+ controller.enqueue(new TextEncoder().encode(JSON.stringify({ a: '1' })));
+ controller.close();
+ },
+ });
+ const oldReq = new Request('http://localhost:3000', {
+ method: 'POST',
+ body: stream,
+ // `duplex` is required when streaming a body; not yet in all lib typings.
+ duplex: 'half',
+ } as RequestInit);
+
  const req = createClerkRequest(oldReq);
- expect((await req.json())['a']).toBe(data.a);
+
+ // The clone carries no body, so it can never lock the original's stream...
+ expect(req.body).toBeNull();
+ // ...and the original stream stays readable for downstream consumers.
+ expect(((await oldReq.json()) as { a: string }).a).toBe('1');
  });
 
  it('retains the url', () => {

packages/backend/src/tokens/clerkRequest.ts

@@ -26,18 +26,22 @@ class ClerkRequest extends Request {
  // https://github.com/nodejs/undici/issues/2155
  // https://github.com/nodejs/undici/blob/7153a1c78d51840bbe16576ce353e481c3934701/lib/fetch/request.js#L854
  const url = typeof input !== 'string' && 'url' in input ? input.url : String(input);
- // When cloning a Request by passing it as init, hide its `signal`. Undici's
- // Request constructor in Node 24 performs a strict instanceof check on the
- // signal and rejects ones from a different realm (e.g. NextRequest). Using a
- // Proxy keeps property access lazy so environments that don't implement
- // optional getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
+ // When cloning a Request by passing it as init, hide its `signal` and `body`.
+ // Undici's Request constructor in Node 24 performs a strict instanceof check on
+ // the signal and rejects ones from a different realm (e.g. NextRequest). The
+ // `body` is hidden because forwarding it makes the clone share the original's
+ // single-use ReadableStream; once either side is read the other throws
+ // "Body is unusable" downstream (issue #8305). Auth only reads the method,
+ // headers, cookies, and URL, so the clone never needs a body. Using a Proxy
+ // keeps property access lazy so environments that don't implement optional
+ // getters (e.g. Cloudflare Workers' Request lacks `cache`) still work.
  let cloneInit: RequestInit | undefined;
  if (init) {
  cloneInit = init;
  } else if (typeof input !== 'string') {
  cloneInit = new Proxy(input as Request, {
  get(target, prop) {
- if (prop === 'signal') {
+ if (prop === 'signal' || prop === 'body') {
  return undefined;
  }
  return Reflect.get(target, prop, target);