These globals are injected automatically into every backend script execution. They are read-only — you cannot modify them directly.
request
Information about the current HTTP request.
request.body
When a page receives a POST request, the body is parsed and available as request.body. Pages accept both GET and POST requests, and the same backend script runs for both, so use request.method to distinguish.
Both JSON (application/json) and ordinary form posts
(application/x-www-form-urlencoded) are parsed, so a plain HTML <form> can
post straight to the page that renders it:
multipart/form-data is not parsed on page routes, so a form with that
enctype (including file uploads) arrives with request.body as null.
The body handed to the script is capped at 64 KB, well below the request
size the server itself accepts. A larger payload is dropped silently:
request.body is null rather than truncated, and nothing is logged. Guard
with if (request.method === 'POST' && request.body) so a page never assumes
a body it did not get.
A subset of request headers is exposed:
Full request headers are not exposed to prevent leaking internal infrastructure details (e.g. proxy headers, auth tokens).
customer
The current customer object from the session, or null if no customer is set. Populated after checkout or check-order login.
is_customer
Boolean. true if the visitor has an active customer session (completed a purchase or logged in via check-order).