{"record":{"id":"262bdbe777ce4b50","repo":"crowdsecurity/crowdsec","slug":"errchallengedifficulty","errorCode":"ErrChallengeDifficulty","errorMessage":"challenge difficulty is impossible","messagePattern":"challenge difficulty is impossible","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/challenge/challenge.go","lineNumber":61,"sourceCode":"\t\"golang.org/x/sync/singleflight\"\n\t\"golang.org/x/sys/cpu\"\n)\n\n// Internal URL paths the challenge runtime intercepts. Bouncers MUST forward\n// these to the WAF unmodified; they are served by the appsec dispatcher\n// (pkg/appsec/appsec.go) rather than by the protected origin.\nconst (\n\tChallengeJSPath        = \"/crowdsec-internal/challenge/challenge.js\"\n\tChallengeSubmitPath    = \"/crowdsec-internal/challenge/submit\"\n\tChallengePowWorkerPath = \"/crowdsec-internal/challenge/pow-worker.js\"\n\tChallengeFPScannerPath = \"/crowdsec-internal/challenge/fpscanner.js\"\n)\n\n// Sentinel errors (reasons) returned by ValidateChallengeResponse.\nvar (\n\tErrChallengeFields     = errors.New(\"missing required fields in challenge response\")\n\tErrChallengeTicket     = errors.New(\"invalid ticket in challenge response\")\n\tErrChallengeDifficulty = errors.New(\"challenge difficulty is impossible\")\n\tErrChallengePoW        = errors.New(\"invalid proof-of-work in challenge response\")\n\tErrChallengeHMAC       = errors.New(\"invalid HMAC in challenge response\")\n\tErrChallengePayload    = errors.New(\"invalid challenge response payload\")\n)\n\n// ChallengeCookieName is the name of the sealed cookie carrying the\n// successfully-validated fingerprint between requests.\nconst ChallengeCookieName = \"__crowdsec_challenge\"\n\n// cryptoObfuscationPoolDefaultSize is how many obfuscations of the per-epoch\n// key module to keep per live epoch. Each variant embeds the same key\n// differently (per-visitor byte variance); default 1 keeps prior behavior.\nconst cryptoObfuscationPoolDefaultSize = 1\n\n// defaultCookieTTL is the default challenge-cookie validity. Decoupled from the\n// keyring window (enforced by not_after in the envelope), so cookies can\n// outlive the per-epoch signing window without widening forgery exposure.\nconst defaultCookieTTL = 12 * time.Hour","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/challenge/challenge.go#L43-L79","documentation":"Sentinel error ErrChallengeDifficulty: the difficulty value submitted by the client in the challenge response is >= PowDifficultyImpossible, i.e. the client claims a difficulty so high it could never have been legitimately issued by the runtime — a sign of a tampered or replayed challenge payload. Mapped to the 'difficulty' failure reason in the appsec dispatcher metrics.","triggerScenarios":"Thrown at pkg/appsec/challenge/challenge.go:61 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Treat as a failed challenge: the request is denied or re-challenged per the appsec remediation config","If false positives occur, verify the client's JS challenge module is up to date and that the difficulty in the issued ticket matches what the server validates"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}