koa-helmet | Important security headers for koa | Application Framework library

You are confusing ctx.body with ctx.request.body, at least in your log statement (in the destructured assignment it is actually correct).

ctx.body is the same as ctx.response.body, it's the response body which is empty because you didn't set it yet.

ctx.request.body is the request body which you actually want.

Some other issues I noticed:

• You use username and password in those ctx.assert lines before they are defined.

• In your duplicate user case, you forgot to return from your function, so the rest of the function will still run and even with an existing user you will create a new one.

_{Since you seem to be working on debugging that error 500: A little tip, error.message is quite useless for debugging as it's missing the stack (most importantly - since this is what shows you where exactly the error came from) and the error class, code and other properties. If you use console.error, always log the whole error object and not just the message: console.error(error). If you want to prepend some text, don't use concatenation, use separate arguments instead, so the object is still formatted: console.error('Error in request:', error).}

_{If you need a string (for example when returning it as response, which you should do only in development mode by the way because you don't want to expose your inner workings to potential attackers), use error.stack and not error.message, because it will contain a lot more information.}