Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

`cf workers secrets update` replaces the entire secret set instead of patching a single secret

Aperta
  • Qualcosa non va?
#96 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
api, cli, cloud

Direzione di ricerca

Start at the cf workers secrets update command entry point and compare its dry-run request with cf workers secrets bulk, including the /secrets and /secrets-bulk endpoints. Reproduce the two-secret sequence from the issue and inspect the existing command tests or request handling. Done means updating one secret leaves other secrets unchanged, with coverage for the reported sequence or clearly documented replacement behavior.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

cf version: 1.0.0-beta.5, macOS

What happens

cf workers secrets update <NAME> --worker <worker> --type secret_text --text <value> sets the named secret, but silently deletes every other secret already on the Worker — it's not a patch, it's a full replace.

Hit this for real while migrating a production Worker (8 secrets already set via wrangler secret put, working fine). Ran cf workers secrets update RUN_TOKEN --worker web-qa-jev-agent --type secret_text --text "<new-token>" to rotate one token. cf workers secrets list --worker web-qa-jev-agent immediately after came back [{"name": "RUN_TOKEN", ...}] — the other 7 (GitHub App auth, webhook secret, target URL) were gone. Broke GitHub App auth and a webhook trigger until manually restored via wrangler secret put.

Repro

cf init repro-cf --package-manager npm
cd repro-cf
cf deploy   # after declaring at least one bindings.secret() per #70/#72's workaround, or use --secrets-file
cf workers secrets update FIRST --worker repro-cf --type secret_text --text a
cf workers secrets list --worker repro-cf     # [FIRST]
cf workers secrets update SECOND --worker repro-cf --type secret_text --text b
cf workers secrets list --worker repro-cf     # [SECOND] -- FIRST is gone

What I found

cf workers secrets update --dry-run shows exactly why:

{
  "command": "cf workers secrets update",
  "method": "PUT",
  "url": "https://api.cloudflare.com/client/v4/accounts/{account}/workers/scripts/{script}/secrets",
  "body": { "name": "SECOND", "type": "secret_text", "text": "b" }
}

It's a PUT to the plain /secrets collection endpoint with only the one secret in the body — a full replace, not a merge. Compare to cf workers secrets bulk --dry-run with the same secret:

{
  "command": "cf workers secrets bulk",
  "method": "PATCH",
  "url": "https://api.cloudflare.com/client/v4/accounts/{account}/workers/scripts/{script}/secrets-bulk",
  "body": { "SECOND": { "type": "secret_text", "text": "b" } }
}

bulk hits a different endpoint (/secrets-bulk) with PATCH/RFC 7396 merge semantics — its own --help text even says "Secrets not included in the request are left unchanged" and recommends it over update for multi-secret changes. But nothing in update's own --help or command name suggests that a single-secret call is just as destructive to every other existing secret. This looks like the same root-cause family as #70/#72/#54 (PUT-only API, no merge-on-single-field-update), specifically for the one command whose entire job description ("Add a secret to a Worker script") implies it should be additive.

Expected

cf workers secrets update either performs a genuine patch (e.g. by using the bulk/secrets-bulk endpoint under the hood when only one secret is given), or its --help/docs state unambiguously that it replaces the whole secret set — right now the command name and description ("Add a secret...") actively suggest the opposite of what it does.

Workaround

Use cf workers secrets bulk --body '{"NAME": {"type": "secret_text", "text": "value"}}' instead of update, always, even for a single secret on a Worker that has others set.

Lingua principale
TypeScript
Stelle
853
Fork
42
Merge medio
16h 43m
PR unite (30g)
160

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di cloudflare/cf

Tutte le issue di cloudflare/cf

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.