{"record":{"id":"0a710c0dbebe128d","repo":"cloudflare/cloudflared","slug":"message-is-too-short-to-contain-a-nonce","errorCode":null,"errorMessage":"message is too short to contain a nonce","messagePattern":"message is too short to contain a nonce","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"token/encrypt.go","lineNumber":72,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\treturn &Encrypter{privateKey: key, publicKey: pubKey}, nil\n}\n\n// PublicKey returns a base64 encoded public key. Useful for transport (like in HTTP requests)\nfunc (e *Encrypter) PublicKey() string {\n\treturn base64.URLEncoding.EncodeToString(e.publicKey[:])\n}\n\n// Decrypt data that was encrypted using our publicKey. It will use our privateKey and the sender's publicKey to decrypt\n// data is an encrypted buffer of data, mostly like from the Encrypt function. Messages contain the nonce data on the front\n// of the message.\n// senderPublicKey is a base64 encoded version of the sender's public key (most likely from the PublicKey function).\n// The return value is the decrypted buffer or an error.\nfunc (e *Encrypter) Decrypt(data []byte, senderPublicKey string) ([]byte, error) {\n\tif len(data) < 24 {\n\t\treturn nil, errors.New(\"message is too short to contain a nonce\")\n\t}\n\tvar decryptNonce [24]byte\n\tcopy(decryptNonce[:], data[:24]) // we pull the nonce from the front of the actual message.\n\tpubKey, err := e.decodePublicKey(senderPublicKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tdecrypted, ok := box.Open(nil, data[24:], &decryptNonce, pubKey, e.privateKey)\n\tif !ok {\n\t\treturn nil, errors.New(\"failed to decrypt message\")\n\t}\n\treturn decrypted, nil\n}\n\n// decodePublicKey will base64 decode the provided key to the box representation\nfunc (e *Encrypter) decodePublicKey(key string) (*[32]byte, error) {\n\tpub, err := base64.URLEncoding.DecodeString(key)\n\tif err != nil {","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/token/encrypt.go#L54-L90","documentation":"This error comes from token.Encrypter.Decrypt when the ciphertext buffer is shorter than 24 bytes, the size of a NaCl secretbox/nonce. Messages produced by Encrypt embed the nonce as the first 24 bytes of the payload, so anything shorter cannot possibly contain one and decryption aborts immediately.","triggerScenarios":"Calling e.Decrypt(data, senderPublicKey) with len(data) < 24 — e.g. an empty or truncated message, passing the plaintext instead of the ciphertext, a base64 payload that was decoded incorrectly, or a store that clipped the record.","commonSituations":"Reading an encrypted token from a file/database that was written by an older format without the nonce prefix; copy-paste or base64 encoding/decoding mistakes dropping bytes; partially-written files; decrypting a non-encrypted value by mistake.","solutions":["Verify the input is the full output of Encrypt (nonce prefix + ciphertext) and that no truncation happened during storage or base64 round-trips.","Check len(data) >= 24 before calling Decrypt and report a clear error about the corrupted/short message.","Confirm the same encryption format/version produced the data — old records without a 24-byte nonce prefix must be re-encrypted.","Ensure base64 decoding uses the same encoding (standard vs URL-safe, with/without padding) that Encrypt's output was stored with."],"exampleFix":"// before\nplain, err := encrypter.Decrypt(shortBlob, senderPub)\n// after\nif len(shortBlob) < 24 {\n    return nil, fmt.Errorf(\"encrypted token too short (%d bytes): missing nonce\", len(shortBlob))\n}\nplain, err := encrypter.Decrypt(shortBlob, senderPub)","handlingStrategy":"validation","validationCode":"if len(data) < 24 {\n    return nil, fmt.Errorf(\"ciphertext too short (%d bytes): nonce missing\", len(data))\n}\nplain, err := e.Decrypt(data, senderPublicKey)","typeGuard":"func hasNoncePrefix(data []byte) bool { return len(data) >= 24 }","tryCatchPattern":"plain, err := e.Decrypt(data, senderPub)\nif err != nil && strings.Contains(err.Error(), \"too short to contain a nonce\") {\n    // treat record as corrupt; re-fetch or re-encrypt\n}","preventionTips":["Store the full Encrypt output (nonce + ciphertext) atomically; avoid partial writes.","Round-trip base64 with the same encoding used at write time.","Reject legacy records without the 24-byte nonce prefix and re-encrypt them.","Sanity-check decoded length right after base64 decoding, before decrypting."],"tags":["crypto","nonce","decryption","token"],"backgroundTag":"invalid-argument-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}