bash-herestring-newline-secrets

name	bash-herestring-newline-secrets
description	Fix password/secret authentication failures caused by trailing newlines when creating Google Cloud secrets (or similar) with bash here-strings. Use when: (1) Password authentication fails with correct password, (2) Secret created with `<<< "value"` syntax, (3) Error like "password authentication failed" or "invalid token" despite correct value. Bash here-strings (`<<<`) add a trailing newline that corrupts secrets.
author	Claude Code
version	1.0.0
date	"2026-01-31T00:00:00.000Z"

Bash Here-String Newline in Secrets

Problem

When creating secrets using bash here-strings (<<<), a trailing newline is silently appended to the value. This causes authentication failures with misleading error messages that suggest the password/token is wrong when it's actually correct—just with an extra newline character.

Context / Trigger Conditions

• Secret created with: gcloud secrets create NAME --data-file=- <<< "value"
• Or similar: echo "value" | gcloud secrets create... (echo adds newline by default)
• Error messages like:
  • "password authentication failed for user X"
  • "invalid token"
  • "authentication failed"
• The secret value appears correct when viewed
• Works locally but fails when secret is used

Solution

Wrong (adds newline):

gcloud secrets create my-secret --data-file=- <<< "mypassword"
echo "mypassword" | gcloud secrets create my-secret --data-file=-

Correct (no newline):

echo -n "mypassword" | gcloud secrets create my-secret --data-file=-
printf '%s' "mypassword" | gcloud secrets create my-secret --data-file=-

To fix an existing secret:

echo -n "correct-value" | gcloud secrets versions add my-secret --data-file=-

Verification

Check the secret length to detect trailing newline:

# Get secret and count bytes
gcloud secrets versions access latest --secret=my-secret | wc -c
# Compare to expected length (password length, not password length + 1)

Or use xxd to see the actual bytes:

gcloud secrets versions access latest --secret=my-secret | xxd | tail -1
# Look for '0a' (newline) at the end

Example

Symptom:

Database connection test failed: password authentication failed for user "crawler"

Investigation:

$ gcloud secrets versions access latest --secret=my-db-password
mypassword
$ gcloud secrets versions access latest --secret=my-db-password | wc -c
11  # But password is only 10 characters!

Fix:

$ echo -n "mypassword" | gcloud secrets versions add my-db-password --data-file=-
Created version [2] of the secret [my-db-password].

Notes

• This affects any system that uses secrets: databases, APIs, tokens, etc.
• The <<< here-string is a bash feature that ALWAYS adds a newline
• echo also adds a newline by default; use echo -n or printf '%s'
• Some systems trim whitespace from secrets, but many (like PostgreSQL) don't
• When debugging auth failures, always check for trailing whitespace first

References

• Bash manual on here-strings: https://www.gnu.org/software/bash/manual/bash.html#Here-Strings