Your worker called response.clone(), but did not read the body of both clones

[Fabb111]

What happened?

Running this

const issuer = new URL("...");
const as = await oauth2
  .discoveryRequest(issuer)
  .then((response) => oauth2.processDiscoveryResponse(issuer, response))

causes Cloudflare Workers to issue the following warning:

Your worker called response.clone(), but did not read the body of both clones. This is wasteful, as it forces the system to buffer the entire response body in memory, rather than streaming it through. This may cause your worker to be unexpectedly terminated for going over the memory limit. If you only meant to copy the response headers and metadata (e.g. in order to be able to modify them), use new Response(response.body, response) instead.

Version

v2.0.1

Runtime

Cloudflare Workers

Runtime Details

Wrangler compatibility_date = "2022-11-25"

Code to reproduce

export default {
	async fetch(
		request: Request,
		env: Env,
		ctx: ExecutionContext
	): Promise<Response> {
		const url = new URL(request.url);

		if (url.pathname === "/") {
			const issuer = new URL("...");
			const as = await oauth2
				.discoveryRequest(issuer)
				.then((response) => oauth2.processDiscoveryResponse(issuer, response))

			console.log(as);

			return new Response(null, { headers, status: 302 });
		} else {
			return new Response(null, { status: 404 });
		}
	},
};

Required

• I have searched the issues tracker and discussions for similar topics and couldn't find anything related.
• I agree to follow this project's Code of Conduct

[panva]

https://github.com/panva/oauth4webapi/blob/v2.0.1/src/index.ts#L764

The response is being read straight after cloning.

It is true that only the clone is being read in your code and this will be true for mostly every response consuming routine, but it is there for a reason, so that in case the library throws while processing the response, the developer can still access its body.

I will change this so that the clone() would have to be done by the developer before this routine as an opt-in.