fix(backend): stop authenticateRequest from consuming the request body

[jacekradko]

ClerkRequest clones the incoming request to read headers, cookies, and URL, but the clone was also forwarding the body. On Node/undici that body is a single-use stream shared with the original, so once anything reads the clone the original throws "Body is unusable" downstream (#8305, e.g. a Hono POST handler calling c.req.json()).

The clone now hides body next to signal in the existing Proxy. I kept the Proxy rather than an explicit RequestInit on purpose: that shape was reverted in e9f8d1a because eagerly reading cache breaks Cloudflare Workers. Auth never touches the body, so dropping it from the clone is safe. The retains the body test asserted the old behavior and is now a streaming-body regression test.

Closes #8305.

[changeset-bot]

🦋 Changeset detected

Latest commit: b21dca3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
@clerk/backend	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview, Comment	May 30, 2026 2:26am

[github-actions]

Snapi: no API changes detected in @clerk/backend, @clerk/clerk-js, @clerk/nextjs, @clerk/react, @clerk/shared, @clerk/ui.

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@8708

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@8708

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@8708

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@8708

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@8708

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@8708

@clerk/express

npm i https://pkg.pr.new/@clerk/express@8708

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@8708

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@8708

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@8708

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@8708

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@8708

@clerk/react

npm i https://pkg.pr.new/@clerk/react@8708

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@8708

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@8708

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@8708

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@8708

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@8708

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@8708

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@8708

commit: b21dca3

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR fixes a bug where ClerkRequest was consuming the incoming HTTP request body stream, preventing downstream handlers from reading it in Node.js environments. The implementation expands inline documentation explaining the Proxy-based approach to lazy property access that preserves the body. The test is updated to verify the original request remains readable after constructing a Clerk request, and a changeset entry documents the fix for @clerk/backend.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: stopping authenticateRequest from consuming the request body, which matches the core objective of the PR.
Description check	✅ Passed	The description is directly related to the changeset, explaining the problem (body consumption), the solution (hiding body in the Proxy), and referencing issue #8305.
Linked Issues check	✅ Passed	The PR fully addresses issue #8305 by preventing body transfer in ClerkRequest's constructor via Proxy-based hiding, avoiding downstream body read failures (#8305).
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing the body consumption issue: test updates, implementation comment clarification, and changeset entry.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

packages/backend/src/tokens/__tests__/clerkRequest.test.ts (1)

7-18: 💤 Low value

Consider adding an explicit return type annotation for clarity.

While the return type is easily inferred as boolean, adding an explicit annotation would improve readability and document the intent.

📝 Optional enhancement

-const supportsStreamConstruction = (() => {
+const supportsStreamConstruction = ((): boolean => {
   try {
     new ReadableStream({

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/backend/src/tokens/__tests__/clerkRequest.test.ts` around lines 7 -
18, The IIFE assigned to supportsStreamConstruction should have an explicit
boolean return type for clarity; update the constant declaration for
supportsStreamConstruction (the immediately-invoked function expression that
constructs a ReadableStream) to include a : boolean return type annotation so
the intent is documented and the inferred type is explicit.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/backend/src/tokens/__tests__/clerkRequest.test.ts`:
- Around line 7-18: The IIFE assigned to supportsStreamConstruction should have
an explicit boolean return type for clarity; update the constant declaration for
supportsStreamConstruction (the immediately-invoked function expression that
constructs a ReadableStream) to include a : boolean return type annotation so
the intent is documented and the inferred type is explicit.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 1cd5ed60-34a6-444e-b621-8de615e4db09

📥 Commits

Reviewing files that changed from the base of the PR and between 87212c5 and b21dca3.

📒 Files selected for processing (3)

• .changeset/clerkrequest-omit-body.md
• packages/backend/src/tokens/__tests__/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• packages/backend/src/tokens/clerkRequest.ts
• .changeset/clerkrequest-omit-body.md