Invalid Headers when API token have `-`

[init-new-world]

Hi Favonia,

I think there is a issue when the API token have - (like sk-12345678), it will cause a 6003 (Invalid header) when communicate with Cloudflare API. I searched a similar issue like cert-manager/cert-manager#3021 , so after I rotate my API token several times and finally I got a token without - , the issue was solved. If we can fix this issue, I think it will be better for future users.

[favonia]

@init-new-world Thank you for the report! This sounds like a very serious issue. Even if Cloudflare is at fault, the tool should, at a minimum, issue a warning and suggest a workaround. I'm reviewing Cloudflare's documentation again, and it seems to indicate that tokens with dashes should work without any special treatment. Their example in their document is:

curl -X GET "https://api.cloudflare.com/client/v4/zones/cd7d0123e3012345da9420df9514dad0" \
     -H "Content-Type:application/json" \
     -H "Authorization: Bearer YQSn-xWAQiiEh9qM58wZNnyQS7FUdoqGIUAbrh7T"

Therefore, I'm quite confused by Cloudflare's server behavior. 😕

If you still have your old tokens with a hyphen, what's the output of the following command?

curl -X GET "https://api.cloudflare.com/client/v4/user/tokens/verify" \
     -H "Authorization: Bearer YOUR-TOKEN"

[init-new-world]

Hi Favonia, I think the result looks well:

# This example include the `-`
{"result":{"id":"Some ID","status":"active"},"success":true,"errors":[],"messages":[{"code":10000,"message":"This API Token is valid and active","type":null}]}

And after I rotate the token and find a token without -, the result is same as before;

This API token I mentioned with the bug is the first API token I created with Cloudflare account and it has a sk- prefix (I don't know whether it is a condition to reproduce it).

Then I try to reproduce the issue, but finally it cannot be reproduced. Maybe there is some issue with Cloudflare at that time.

Anyway, I think we can mention this situation like FAQ in some places when someone meet the same issue like me and then they won't waste much time to fix it (just rotate key is enough)

[init-new-world]

By the way, I reproduced the 6003 code condition:

In headers:

Authorization: Bearer abcdefg

When the abcdefg has not same length with the normal token length, it will get a code:6003 with Invalid request headers;

If the abcdefg has the same length with my other API token but its content is not correct, the server will response code:1000 with Invalid API Token.

So another possibility is I copied the token incorrect (like missing the last character).

[favonia]

Anyway, I think we can mention this situation like FAQ in some places when someone meet the same issue like me and then they won't waste much time to fix it (just rotate key is enough)

Thanks for the testing and suggestion. I will implement your suggestion when I have more bandwidth. Thanks.