Merge pull request #1034 from supertokens/fix/send-json-response-not-being-ignored

fix: send json response not being ignored

Author: porcellus

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+## [23.1.0] - 2025-11-25
+
+-   Fix the OAuth2Provider `tokenExchange` error message when the refresh token is expired
+-   Updates custom framework to following correct CollectingResponse flow order (to ensure that subsequent calls to the `sendJSONResponse` doesn't overwrite the response).
+
 ## [23.0.1] - 2025-07-31
 
 -   Updated FDI support to 4.2
@@ -15,7 +20,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 -   Fix WebAuthn credential listing and removal to work even when the WebAuthn user is not the primary user and when there are multiple WebAuthn users linked
 -   Prevent removal of WebAuthn credentials unless all session claims are satisfied
 -   Change how sessions are fetched before listing, removing and adding WebAuthn credentials
--   Fix the OAuth2Provider `tokenExchange` error message when the refresh token is expired
 
 ## [23.0.0] - 2025-07-21
 

lib/build/framework/custom/framework.d.ts

@@ -103,6 +103,7 @@ export class CollectingResponse extends BaseResponse {
     public readonly headers: Headers;
     public readonly cookies: CookieInfo[];
     public body?: string;
+    private responseSet: boolean;
 
     constructor() {
         super();
@@ -115,11 +116,15 @@ export class CollectingResponse extends BaseResponse {
         }
         this.statusCode = 200;
         this.cookies = [];
+        this.responseSet = false;
     }
 
     sendHTMLResponse = (html: string) => {
-        this.headers.set("Content-Type", "text/html");
-        this.body = html;
+        if (!this.responseSet) {
+            this.headers.set("Content-Type", "text/html");
+            this.body = html;
+            this.responseSet = true;
+        }
     };
 
     setHeader = (key: string, value: string, allowDuplicateKey: boolean) => {
@@ -158,12 +163,17 @@ export class CollectingResponse extends BaseResponse {
      * @param {number} statusCode
      */
     setStatusCode = (statusCode: number) => {
-        this.statusCode = statusCode;
+        if (!this.responseSet) {
+            this.statusCode = statusCode;
+        }
     };
 
     sendJSONResponse = (content: any) => {
-        this.headers.set("Content-Type", "application/json");
-        this.body = JSON.stringify(content);
+        if (!this.responseSet) {
+            this.headers.set("Content-Type", "application/json");
+            this.body = JSON.stringify(content);
+            this.responseSet = true;
+        }
     };
 }
 

lib/build/framework/custom/framework.js

@@ -12,7 +12,7 @@
  * License for the specific language governing permissions and limitations
  * under the License.
  */
-export const version = "23.0.1";
+export const version = "23.0.2";
 
 export const cdiSupported = ["5.3"];