Containers: an authorized_keys public_key with a space in its comment passes config validation, then wrangler deploy fails with a 400

Open Beginner friendly
  • Is something wrong?
#16,692 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
cloud, typescript
Domain
cli, cloud

Research direction

The authorized_keys check lives in packages/workers-utils/src/config/validation.ts, where it confirms the value starts with ssh-ed25519 but never counts the fields after it. Start by reading that function, then run the new cases in packages/workers-utils/tests/config/validation/normalize-and-validate-config.test.ts. Done means a key whose comment contains a space fails validation with an error naming containers.authorized_keys[n].public_key, while keys with no comment, a one-word comment, or a tab in the comment still pass.

Written by the indexing model from the issue text.

Description

bug error-messaging package:workers-utils product:containers
What versions & operating system are you using?
  System:
    OS: macOS 27.2
    CPU: (16) arm64 Apple M4 Max
  Binaries:
    Node: 24.22.1
    pnpm: 12.16.1
  npmPackages:
    wrangler: 4.153.0 (used for the four deploys below)
Please provide a link to a minimal reproduction

Fix branch: https://github.com/cloudflare/workers-sdk/compare/main...tlq5l:workers-sdk:fix/containers-authorized-key-comment-spaces

Failing test: https://github.com/tlq5l/workers-sdk/blob/6bffa26bd807d9a7d3827fe75f30699901fcd847/packages/workers-utils/tests/config/validation/normalize-and-validate-config.test.ts#L6542

That branch adds two tests to packages/workers-utils/tests/config/validation/normalize-and-validate-config.test.ts. On main the first one fails: the config check reports no error for the key below.

Config that reproduces it. Replace the shortened key with the .pub line from ssh-keygen -t ed25519 -C "my laptop":

{
  "containers": [
    {
      "class_name": "MyContainer",
      "image": "./Dockerfile",
      "authorized_keys": [
        { "name": "laptop", "public_key": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... my laptop" }
      ]
    }
  ]
}
Describe the Bug

An authorized_keys entry whose public_key comment contains a space (here my laptop, which is what ssh-keygen -C "my laptop" gives you) passes Wrangler's local config check, and wrangler deploy then fails with a 400 from the API. The error does not say which entry or field is wrong.

We checked this with one real ED25519 key deployed four times to a test Worker, changing only the comment:

  • no comment: deployed
  • probe: deployed
  • my<TAB>probe (a tab, not a space): deployed
  • my probe: rejected, error below

Expected: Wrangler rejects the key before deploying, with an error that names containers.authorized_keys[n].public_key and says the comment must not contain spaces.

The check in packages/workers-utils/src/config/validation.ts confirms the value is a string starting with ssh-ed25519 but does not check how many fields follow. We have a five-line fix on the branch above: it reports a config error when the key splits into more than three space-separated fields, which matches the four results. Keys with no comment, a one-word comment or a tab in the comment are unchanged, and a second test covers those. trusted_user_ca_keys uses the same validator, so the check would apply there too; we did not test the API with CA keys.

Happy to open a PR from that branch if you'd like one.

Please provide any relevant error logs
Invalid input: Invalid Authorized Key format. Syntax is space-separated: keytype, base64-encoded key, comment(optional).

(400 from the API during wrangler deploy, for the my probe case.)

[!NOTE]
This issue was written by an AI agent: Claude (Anthropic), on behalf of tlq5l.

Dominant language
TypeScript
Stars
4.7k
Forks
1.6k
Avg merge
1d 20h
Merged PRs (30d)
257

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cloudflare/workers-sdk

All issues in cloudflare/workers-sdk

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.