feat(project): increase securityTokenHeader max_length from 20 to 64#112483
Merged
feat(project): increase securityTokenHeader max_length from 20 to 64#112483
Conversation
The security token header field was capped at 20 characters, which is too restrictive for common header names (e.g. X-Custom-Security-Header). Increase the limit to 64 to accommodate real-world use cases. Add test_security_token_header_max_length to cover boundary acceptance (exactly 64 chars) and rejection (65 chars), matching prior art test patterns for field length validation in this test class.
github-actions
bot
added
the
Scope: Backend
wedamija
approved these changes
Apr 8, 2026
markstory
added
the
Trigger: getsentry tests
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Increases the
securityTokenHeaderfield limit from 20 to 64 characters in the project settings serializer.The previous 20-char cap was too restrictive — common header names like
X-Custom-Security-Header(26 chars) hit the limit. 64 is a more practical ceiling that still constrains unbounded input.Changes
src/sentry/core/endpoints/project_details.py:max_length=20→max_length=64onsecurityTokenHeaderfieldtests/sentry/core/endpoints/test_project_details.py: addstest_security_token_header_max_lengthcovering:Test pattern matches prior art in the same test class (e.g.
test_sensitive_fields_too_long,test_store_crash_reports_exceeded).