fix(backend): Handle "Cannot convert argument to a ByteString" errors (…

…#4244)

.changeset/yellow-lobsters-smile.md

@@ -0,0 +1,5 @@
+---
+"@clerk/backend": patch
+---
+
+Handle "Cannot convert argument to a ByteString" errors

packages/backend/src/tokens/__tests__/authStatus.test.ts

@@ -30,6 +30,16 @@ export default (QUnit: QUnit) => {
       assert.strictEqual(authObject.headers.get('x-clerk-auth-reason'), 'auth-reason');
       assert.strictEqual(authObject.headers.get('x-clerk-auth-message'), 'auth-message');
     });
+
+    test('handles debug headers containing invalid unicode characters without throwing', assert => {
+      const headers = new Headers({ 'custom-header': 'value' });
+      const authObject = signedOut({} as any, 'auth-reason+RR�56', 'auth-message+RR�56', headers);
+
+      assert.strictEqual(authObject.headers.get('custom-header'), 'value');
+      assert.strictEqual(authObject.headers.get('x-clerk-auth-status'), 'signed-out');
+      assert.strictEqual(authObject.headers.get('x-clerk-auth-reason'), null);
+      assert.strictEqual(authObject.headers.get('x-clerk-auth-message'), null);
+    });
   });
 
   module('handshake', () => {

packages/backend/src/tokens/authStatus.ts

@@ -158,13 +158,27 @@ const withDebugHeaders = <T extends RequestState>(requestState: T): T => {
   const headers = new Headers(requestState.headers || {});
 
   if (requestState.message) {
-    headers.set(constants.Headers.AuthMessage, requestState.message);
+    try {
+      headers.set(constants.Headers.AuthMessage, requestState.message);
+    } catch (e) {
+      // headers.set can throw if unicode strings are passed to it. In this case, simply do nothing
+    }
   }
+
   if (requestState.reason) {
-    headers.set(constants.Headers.AuthReason, requestState.reason);
+    try {
+      headers.set(constants.Headers.AuthReason, requestState.reason);
+    } catch (e) {
+      /* empty */
+    }
   }
+
   if (requestState.status) {
-    headers.set(constants.Headers.AuthStatus, requestState.status);
+    try {
+      headers.set(constants.Headers.AuthStatus, requestState.status);
+    } catch (e) {
+      /* empty */
+    }
   }
 
   requestState.headers = headers;