diff --git a/gssapi-wai.cabal b/gssapi-wai.cabal
--- a/gssapi-wai.cabal
+++ b/gssapi-wai.cabal
@@ -1,5 +1,5 @@
 name:                gssapi-wai
-version:             0.1.2.2
+version:             0.1.2.3
 synopsis:            WAI Middleware for SPNEGO authentiaction
 description:         Basic WAI Middleware allows both SPNEGO and failback to Kerberos
                      username/password authentication.
diff --git a/src/Network/Wai/Middleware/SpnegoAuth.hs b/src/Network/Wai/Middleware/SpnegoAuth.hs
--- a/src/Network/Wai/Middleware/SpnegoAuth.hs
+++ b/src/Network/Wai/Middleware/SpnegoAuth.hs
@@ -57,6 +57,8 @@
   , spnegoOnAuthError   :: SpnegoAuthSettings -> Maybe (Either KrbException GssException) -> Application
     -- ^ Called upon GSSAPI/Kerberos error. It is supposed to return 401 return code with
     --   'Authorize: Negotiate' and possibly 'Authorize: Basic realm=...' headers
+    --
+    -- You MUST flush the request body in this method, otherwise POST/PUT/etc. requests mysteriously fail.
   , spnegoFakeBasicAuth :: Bool -- ^ Fake 'Authorization: ' basic header for applications relying on Basic auth
 }
 
@@ -73,8 +75,10 @@
   }
 
 -- | Genereate HTTP response that asks client to do appropriate authentication
-defaultAuthResponse :: SpnegoAuthSettings -> (Response -> IO ResponseReceived) -> IO ResponseReceived
-defaultAuthResponse settings respond = respond $ responseLBS status401 (authHeaders settings) "Unauthorized"
+defaultAuthResponse :: SpnegoAuthSettings -> Request -> (Response -> IO ResponseReceived) -> IO ResponseReceived
+defaultAuthResponse settings request respond = do
+    flushRequestBody request
+    respond $ responseLBS status401 (authHeaders settings) "Unauthorized"
   where
     authHeaders SpnegoAuthSettings{spnegoBasicFailback=True, spnegoRealm=Just realm} =
         [(hWWWAuthenticate, "Negotiate"), (hWWWAuthenticate, "Basic realm=\"" <> realm <> "\"")]
@@ -82,16 +86,23 @@
         [(hWWWAuthenticate, "Negotiate"), (hWWWAuthenticate, "Basic realm=\"Auth\"")]
     authHeaders SpnegoAuthSettings{spnegoBasicFailback=False} = [(hWWWAuthenticate, "Negotiate")]
 
+flushRequestBody :: Request -> IO ()
+flushRequestBody req = do
+    res <- requestBody req
+    case res of
+        "" -> return ()
+        _ -> flushRequestBody req
+
 -- | Default authentication for filling in spnegoOnAuthError
 defaultAuthError :: (String -> IO ()) -> SpnegoAuthSettings -> Maybe (Either KrbException GssException) -> Application
-defaultAuthError _ settings Nothing _ respond = defaultAuthResponse settings respond
-defaultAuthError logerr settings (Just (Left (KrbException code err))) _ respond = do
+defaultAuthError _ settings Nothing req respond = defaultAuthResponse settings req respond
+defaultAuthError logerr settings (Just (Left (KrbException code err))) req respond = do
     logerr $ "Kerberos error code: " <> show code <> ", error: " <> show err
-    defaultAuthResponse settings respond
-defaultAuthError logerr settings (Just (Right (GssException major majorTxt minor minorTxt))) _ respond = do
+    defaultAuthResponse settings req respond
+defaultAuthError logerr settings (Just (Right (GssException major majorTxt minor minorTxt))) req respond = do
     logerr $ "GSSAPI major code: " <> show major <> ", error: " <> show majorTxt
                <> ", minor code: " <> show minor <> ", error: " <> show minorTxt
-    defaultAuthResponse settings respond
+    defaultAuthResponse settings req respond
 
 -- | Key that is used to access the username in WAI vault
 spnegoAuthKey :: V.Key BS.ByteString