[workers-auth] Validate account IDs before using them in API requests by edmundhung · Pull Request #13746 · cloudflare/workers-sdk

edmundhung · 2026-04-29T22:37:25Z

Fixes #8380.

Tests
- Tests included/updated
- Automated tests not possible - manual testing has been completed as follows:
- Additional testing not necessary because:
Public documentation
- Cloudflare docs PR(s):
- Documentation not necessary because: bugfix

A picture of a cute animal (not mandatory, but encouraged)

changeset-bot · 2026-04-29T22:37:29Z

🦋 Changeset detected

Latest commit: feb4369

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 5 packages

Name	Type
@cloudflare/workers-auth	Patch
wrangler	Patch
@cloudflare/remote-bindings	Patch
@cloudflare/vite-plugin	Patch
@cloudflare/vitest-pool-workers	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-04-29T22:38:09Z

✅ All changesets look good

ask-bonk · 2026-04-29T22:41:00Z

The analysis is complete. Let me now assess the overall quality of this PR:

Summary: The PR validates account IDs from user-controlled sources (config file and environment variable) before they're used in API URL paths, preventing a confusing ByteString error when non-ASCII characters are present.

Assessment:

The validation regex ^[A-Za-z0-9_-]+$ is reasonable -- it's intentionally permissive (real Cloudflare account IDs are 32-char hex, but the goal is to prevent non-ASCII characters that cause ByteString failures, not to enforce the exact format).
The validation is placed at the right chokepoints: getAccountId() for config values, getCloudflareAccountIdFromEnv() for env var values, and explicitly in containers/deploy.ts for its direct config.account_id usage.
The exploration agent confirmed all code paths are covered -- no gaps.
Tests cover both the config and env var paths with appropriate assertions.
The containers/deploy.ts import ordering (../user/account-id before ../user) is technically fine since these are sibling-depth imports and the formatter will sort them.
The changeset is correct.
The empty string check in getCloudflareAccountIdFromEnv() is a good defensive measure.

I don't see any logic bugs, security issues, backward compatibility problems, or incorrect API behavior.

LGTM

github run

pkg-pr-new · 2026-04-29T22:42:08Z

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@13746

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@13746

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@13746

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@13746

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@13746

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@13746

miniflare

npm i https://pkg.pr.new/miniflare@13746

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@13746

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@13746

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@13746

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@13746

@cloudflare/vitest-pool-workers

npm i https://pkg.pr.new/@cloudflare/vitest-pool-workers@13746

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@13746

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@13746

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@13746

wrangler

npm i https://pkg.pr.new/wrangler@13746

commit: feb4369

workers-devprod · 2026-04-30T10:31:27Z

Codeowners approval required for this PR:

@cloudflare/cloudchamber
@cloudflare/wrangler

Show detailed file reviewers

packages/wrangler/src/tests/pages/project-list.test.ts: [@cloudflare/wrangler]
packages/wrangler/src/tests/user.test.ts: [@cloudflare/wrangler]
packages/wrangler/src/containers/deploy.ts: [@cloudflare/cloudchamber @cloudflare/wrangler]
packages/wrangler/src/user/account-id.ts: [@cloudflare/wrangler]
packages/wrangler/src/user/auth-variables.ts: [@cloudflare/wrangler]
packages/wrangler/src/user/user.ts: [@cloudflare/wrangler]

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

Account IDs are substituted straight into Cloudflare API URL paths, so a value containing non-ASCII characters failed deep inside the request layer with an opaque `Cannot convert argument to a ByteString` error. Validate `CLOUDFLARE_ACCOUNT_ID` and the consumer's `account_id` config field up front, and report which setting holds the offending value.

workers-devprod · 2026-07-30T16:26:41Z

Codeowners approval required for this PR:

✅ @cloudflare/wrangler

Show detailed file reviewers

devin-ai-integration

Devin Review found 1 new potential issue.

workers-devprod

Codeowners reviews satisfied

workers-devprod added this to workers-sdk Apr 29, 2026

github-project-automation Bot moved this to Untriaged in workers-sdk Apr 29, 2026

edmundhung marked this pull request as ready for review April 30, 2026 10:30

edmundhung requested a review from workers-devprod as a code owner April 30, 2026 10:30

workers-devprod requested review from a team and ascorbic and removed request for a team April 30, 2026 10:31

devin-ai-integration Bot reviewed Apr 30, 2026

View reviewed changes

petebacondarwin marked this pull request as draft May 2, 2026 13:26

petebacondarwin force-pushed the edmundhung/fix-account-id-validation branch from 39f7d78 to feb4369 Compare July 30, 2026 16:23

petebacondarwin changed the title ~~fix(wrangler): validate account IDs before API calls~~ [workers-auth] Validate account IDs before using them in API requests Jul 30, 2026

petebacondarwin marked this pull request as ready for review July 30, 2026 16:26

petebacondarwin requested review from petebacondarwin and removed request for ascorbic July 30, 2026 16:26

devin-ai-integration Bot reviewed Jul 30, 2026

View reviewed changes

Comment thread packages/workers-auth/src/env-vars.ts

petebacondarwin approved these changes Jul 30, 2026

View reviewed changes

workers-devprod approved these changes Jul 30, 2026

View reviewed changes

github-project-automation Bot moved this from Untriaged to Approved in workers-sdk Jul 30, 2026

petebacondarwin merged commit cec9d88 into main Jul 31, 2026
70 of 72 checks passed

petebacondarwin deleted the edmundhung/fix-account-id-validation branch July 31, 2026 10:47

github-project-automation Bot moved this from Approved to Done in workers-sdk Jul 31, 2026

workers-devprod mentioned this pull request Jul 31, 2026

Version Packages #14946

Merged

petebacondarwin mentioned this pull request Jul 31, 2026

[fixtures] Update invalid account id snapshot for client-side account id validation #14948

Merged

5 tasks

Navigation Menu

Uh oh!

[workers-auth] Validate account IDs before using them in API requests - #13746

[workers-auth] Validate account IDs before using them in API requests#13746
petebacondarwin merged 1 commit into
mainfrom
edmundhung/fix-account-id-validation

edmundhung commented Apr 29, 2026

Uh oh!

changeset-bot Bot commented Apr 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 29, 2026 •

edited

Loading

Uh oh!

ask-bonk Bot commented Apr 29, 2026

Uh oh!

pkg-pr-new Bot commented Apr 29, 2026 •

edited

Loading

Uh oh!

workers-devprod commented Apr 30, 2026

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

workers-devprod commented Jul 30, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

Uh oh!

workers-devprod left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

edmundhung commented Apr 29, 2026

Uh oh!

changeset-bot Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

github-actions Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ask-bonk Bot commented Apr 29, 2026

Uh oh!

pkg-pr-new Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

workers-devprod commented Apr 30, 2026

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

workers-devprod commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

workers-devprod left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

changeset-bot Bot commented Apr 29, 2026 •

edited

Loading

github-actions Bot commented Apr 29, 2026 •

edited

Loading

pkg-pr-new Bot commented Apr 29, 2026 •

edited

Loading

workers-devprod commented Jul 30, 2026 •

edited

Loading