{"record":{"id":"2dc7632c0dd1c9b8","repo":"crowdsecurity/crowdsec","slug":"errchallengepayload","errorCode":"ErrChallengePayload","errorMessage":"invalid challenge response payload","messagePattern":"invalid challenge response payload","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/challenge/challenge.go","lineNumber":64,"sourceCode":"\n// Internal URL paths the challenge runtime intercepts. Bouncers MUST forward\n// these to the WAF unmodified; they are served by the appsec dispatcher\n// (pkg/appsec/appsec.go) rather than by the protected origin.\nconst (\n\tChallengeJSPath        = \"/crowdsec-internal/challenge/challenge.js\"\n\tChallengeSubmitPath    = \"/crowdsec-internal/challenge/submit\"\n\tChallengePowWorkerPath = \"/crowdsec-internal/challenge/pow-worker.js\"\n\tChallengeFPScannerPath = \"/crowdsec-internal/challenge/fpscanner.js\"\n)\n\n// Sentinel errors (reasons) returned by ValidateChallengeResponse.\nvar (\n\tErrChallengeFields     = errors.New(\"missing required fields in challenge response\")\n\tErrChallengeTicket     = errors.New(\"invalid ticket in challenge response\")\n\tErrChallengeDifficulty = errors.New(\"challenge difficulty is impossible\")\n\tErrChallengePoW        = errors.New(\"invalid proof-of-work in challenge response\")\n\tErrChallengeHMAC       = errors.New(\"invalid HMAC in challenge response\")\n\tErrChallengePayload    = errors.New(\"invalid challenge response payload\")\n)\n\n// ChallengeCookieName is the name of the sealed cookie carrying the\n// successfully-validated fingerprint between requests.\nconst ChallengeCookieName = \"__crowdsec_challenge\"\n\n// cryptoObfuscationPoolDefaultSize is how many obfuscations of the per-epoch\n// key module to keep per live epoch. Each variant embeds the same key\n// differently (per-visitor byte variance); default 1 keeps prior behavior.\nconst cryptoObfuscationPoolDefaultSize = 1\n\n// defaultCookieTTL is the default challenge-cookie validity. Decoupled from the\n// keyring window (enforced by not_after in the envelope), so cookies can\n// outlive the per-epoch signing window without widening forgery exposure.\nconst defaultCookieTTL = 12 * time.Hour\n\n// DefaultChallengeCSP is the Content-Security-Policy header used on the\n// challenge page when the operator hasn't configured a custom one. Allows","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/challenge/challenge.go#L46-L82","documentation":"Sentinel error ErrChallengePayload: the challenge submission body could not be parsed as a URL query string (wrapped with url.ParseQuery's error). The client posted a body that is not form-encoded key/value pairs. Mapped to the 'payload' failure reason in appsec metrics.","triggerScenarios":"Thrown at pkg/appsec/challenge/challenge.go:64 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the challenge submit endpoint receives POST bodies with application/x-www-form-urlencoded or query-string encoding","Check no intermediary (bouncer, proxy) rewrites or re-encodes the challenge.js submit body"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}