SuperTokens is an open source authentication solution offering features like: Different types of login: Email / password, Passwordless (OTP or Magic link based).

SuperTokens.com

Hey guys,
I am  observing  this weird  behaviour  where  for POST requests body is empty when backend receives  the request and i can see the payload in the browser when ui makes the api call...
is this something to do with supertokens configuration?

hey <@784800327852752898> can you elaborate?

so basically when the ui makes the api call say with method `POST` with json payload, on the backend when it receives  the call the body is empty

it's not an API related to supertokens, it's part of my application

i was just wondering does it have to do with any configuration on supertokens...

my UI running on my local machine, where as my backend is deployed as a https server on cloud

so i just removed the middleware session verification of supertoken for that API, it's working fine now

so i guess it has something do with supertokens configuration

Can I see how you are using the middleware?

`func VerifySession(options *sessmodels.VerifySessionOptions) gin.HandlerFunc {
    return func(c *gin.Context) {

        session.VerifySession(options, func(rw http.ResponseWriter, r *http.Request) {
            c.Request = c.Request.WithContext(r.Context())
            c.Next()
        })(c.Writer, c.Request)
        // we call Abort so that the next handler in the chain is not called, unless we call Next explicitly
        c.Abort()
    }
}`

have you checked if the tokens are being passed correctly along with the request?

also, can you try with `SessionRequired` set to `false` in the `VerifySessionOptions` makes the API work as expected ?

<@908641146379579433> the issue is that "requests body is empty when backend receives  the request" -> this probably means that SessionRequired is already false.

<@784800327852752898> can you help us reproduce this issue? So that we can fix it asap. Maybe open an issue about this on our GitHub describing your setup and the request being made.

i set the `AntiCsrf` to `NONE` it started to work now

i see. Were you setting SessionRequired to false?

nope
but now requests are working fine from postman but from UI i am still having the same issue

it seems that the session verification is failing, and instead of returning a 401, it's letting the API continue with execution?

<@784800327852752898> please share debug logs from backend, while you perform the request from the UI. you can enable it by setting env SUPERTOKENS_DEBUG=1