fix(wrangler): reject secrets-store secret values larger than 64 KiB by shiminshen · Pull Request #14020 · cloudflare/workers-sdk

shiminshen · 2026-05-23T01:51:26Z

What this PR addresses

#14018 — wrangler secrets-store secret create lets users create secrets longer than 1024 characters even though the Cloudflare API silently discards anything over the cap. The CLI claims success, secret list even shows the secret, but any worker that binds to it then fails at deploy time with a misleading "secret doesn't exist" error. The dashboard already enforces the 1024-char cap and never shows these orphan secrets.

What changed

packages/wrangler/src/secrets-store/commands.ts
- Add MAX_SECRET_VALUE_LENGTH = 1024 and a validateSecretValue helper sitting next to the existing validateSecretName. The error message names the cap, the actual length received, and why the API rejects it, so the user can fix it without round-tripping through the dashboard.
- Call validateSecretValue from the create handler after the value is gathered (args.value or the interactive prompt).
- Call validateSecretValue from the update handler only when a new value is being supplied — the command intentionally allows updating just scopes or comment without re-supplying the value.
packages/wrangler/src/__tests__/secrets-store.test.ts — new test under the existing secrets-store secret create describe block that sends a 1025-character value and asserts the new error message, mirroring the pattern of the existing missing-field error tests.
Changeset (patch to wrangler).

Notes

The cap is enforced client-side at the CLI surface, before any API call, so it doesn't change behaviour for users who are already under the limit.
I considered making the check happen inside the client.ts createSecret / updateSecret calls instead, but kept it at the handler so the error is symmetrical with the existing validateSecretName call (which also runs at handler / validateArgs time, not at the API call site).

Tests
- Tests included/updated
- Automated tests not possible - manual testing has been completed as follows:
- Additional testing not necessary because:
Public documentation
- Cloudflare docs PR(s):
- Documentation not necessary because: this PR adds client-side validation matching an existing API-side constraint that the dashboard already enforces. It surfaces a clearer error for an already-failing case but does not change documented behaviour, add new flags, or modify any output that user-facing docs reference.

…aracters The CLI was accepting overly long values, returning a successful response, and listing the secret as if it were stored — but the Cloudflare API discards anything over 1024 characters, so any worker binding to that secret then fails at deploy time with a confusing "secret doesn't exist" error. The dashboard already enforces the same 1024 cap and never shows these orphaned secrets. Add `validateSecretValue` next to the existing `validateSecretName` and call it from both the `create` and `update` handlers (in the update case, only when a new value is actually being supplied — the command allows updating just scopes or comment). Cover the create path with a unit test mirroring the existing missing-field error tests. Fixes cloudflare#14018

changeset-bot · 2026-05-23T01:51:30Z

🦋 Changeset detected

Latest commit: 63c9210

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
wrangler	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

workers-devprod · 2026-05-23T01:51:47Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

pkg-pr-new · 2026-05-23T01:58:11Z

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@14020

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@14020

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@14020

miniflare

npm i https://pkg.pr.new/miniflare@14020

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@14020

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@14020

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@14020

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@14020

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@14020

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@14020

wrangler

npm i https://pkg.pr.new/wrangler@14020

commit: 63c9210

dario-piotrowicz · 2026-05-26T09:40:58Z

Thank you very much for the PR @shiminshen 🙏

The API does not seem to actually enforce this cap, only the dashboard is, before reviewing your PR I need to check with the secret store team if that's intentional (besides that the changes here look good to me)

dario-piotrowicz · 2026-05-26T14:07:38Z

Hi @shiminshen, I checked with the team and they did let me know that the limit has been increased to 64 KiB see: api docs

Could you update the PR to respect this new upper limit? 🙏

The API limit was 1024 characters when this PR was opened, but the secrets-store team has since raised it to 64 KiB (65,536 bytes). Validate by UTF-8 byte length to match the API doc exactly -- character-length would under-count multi-byte unicode and let oversize values slip through.

shiminshen · 2026-05-26T14:29:19Z

Thanks for checking with the team @dario-piotrowicz! Updated in fe1e398:

Cap raised to 64 KiB (65,536 bytes) — matches the API doc.
Validation now uses Buffer.byteLength(value, "utf8") instead of value.length, since the API doc specifies the limit in bytes ("Maximum 64 KiB (65,536 bytes)"). Character-length would under-count multi-byte unicode and could let oversize values through.
Test, error message, changeset, and PR title all updated accordingly.

dario-piotrowicz

Looks great to me! Thank you very much @shiminshen! 🙏

I just left one last comment, everything else beside that is great for me!

workers-devprod

Codeowners reviews satisfied

Co-authored-by: Dario Piotrowicz <dario.piotrowicz@gmail.com>

shiminshen requested a review from workers-devprod as a code owner May 23, 2026 01:51

workers-devprod added this to workers-sdk May 23, 2026

github-project-automation Bot moved this to Untriaged in workers-sdk May 23, 2026

workers-devprod requested review from a team and dario-piotrowicz and removed request for a team May 23, 2026 01:51

devin-ai-integration Bot reviewed May 23, 2026

View reviewed changes

shiminshen changed the title ~~fix(wrangler): reject secrets-store secret values longer than 1024 characters~~ fix(wrangler): reject secrets-store secret values larger than 64 KiB May 26, 2026

Merge branch 'main' into fix/secrets-store-length-validation

ab0cd6c

dario-piotrowicz approved these changes May 27, 2026

View reviewed changes

Comment thread .changeset/fix-secrets-store-value-length-validation.md Outdated

workers-devprod approved these changes May 27, 2026

View reviewed changes

github-project-automation Bot moved this from Untriaged to Approved in workers-sdk May 27, 2026

shiminshen and others added 3 commits May 27, 2026 10:21

Update .changeset/fix-secrets-store-value-length-validation.md

4b29f4a

Co-authored-by: Dario Piotrowicz <dario.piotrowicz@gmail.com>

Merge branch 'main' into fix/secrets-store-length-validation

004bfc6

Merge branch 'main' into fix/secrets-store-length-validation

63c9210

dario-piotrowicz merged commit 9dee4cc into cloudflare:main May 28, 2026
58 of 59 checks passed

github-project-automation Bot moved this from Approved to Done in workers-sdk May 28, 2026

workers-devprod mentioned this pull request May 28, 2026

Version Packages #14048

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(wrangler): reject secrets-store secret values larger than 64 KiB#14020

fix(wrangler): reject secrets-store secret values larger than 64 KiB#14020
dario-piotrowicz merged 6 commits into
cloudflare:mainfrom
shiminshen:fix/secrets-store-length-validation

shiminshen commented May 23, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented May 23, 2026 •

edited

Loading

Uh oh!

workers-devprod commented May 23, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

pkg-pr-new Bot commented May 23, 2026 •

edited

Loading

Uh oh!

dario-piotrowicz commented May 26, 2026

Uh oh!

dario-piotrowicz commented May 26, 2026

Uh oh!

shiminshen commented May 26, 2026

Uh oh!

dario-piotrowicz left a comment

Uh oh!

Uh oh!

workers-devprod left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

shiminshen commented May 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR addresses

What changed

Notes

Uh oh!

changeset-bot Bot commented May 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

workers-devprod commented May 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

pkg-pr-new Bot commented May 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dario-piotrowicz commented May 26, 2026

Uh oh!

dario-piotrowicz commented May 26, 2026

Uh oh!

shiminshen commented May 26, 2026

Uh oh!

dario-piotrowicz left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

workers-devprod left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

shiminshen commented May 23, 2026 •

edited

Loading

changeset-bot Bot commented May 23, 2026 •

edited

Loading

workers-devprod commented May 23, 2026 •

edited

Loading

pkg-pr-new Bot commented May 23, 2026 •

edited

Loading