{"record":{"id":"365b0f0ff5dfc2d7","repo":"crowdsecurity/crowdsec","slug":"errcookiemalformed","errorCode":"ErrCookieMalformed","errorMessage":"%w: failed to decode: %w","messagePattern":"%w: failed to decode: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/challenge/crypto.go","lineNumber":200,"sourceCode":"\tAllowlistReason string\n\tNotAfter        int64\n}\n\n// openCookie decodes a sealed cookie, dispatching on the version byte.\n// Unknown versions are rejected with ErrCookieVersion. Expired cookies\n// (notAfter <= now) are rejected with ErrCookieExpired.\nfunc openCookie(encoded string, masterCookieKey []byte, aad []byte, maxCookieLen int) (*CookieEnvelope, error) {\n\tif maxCookieLen <= 0 {\n\t\tmaxCookieLen = MaxCookieLen\n\t}\n\n\tif len(encoded) > maxCookieLen {\n\t\treturn nil, fmt.Errorf(\"%w: %d > %d\", ErrCookieTooLarge, len(encoded), maxCookieLen)\n\t}\n\n\traw, err := base64.RawURLEncoding.DecodeString(encoded)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%w: failed to decode: %w\", ErrCookieMalformed, err)\n\t}\n\tif len(raw) < 1 {\n\t\treturn nil, fmt.Errorf(\"%w: empty cookie\", ErrCookieMalformed)\n\t}\n\n\tswitch raw[0] {\n\tcase cookieVersionV0:\n\t\treturn openCookieV0Bytes(raw[1:], masterCookieKey, aad, time.Now())\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"%w: 0x%02x\", ErrCookieVersion, raw[0])\n\t}\n}\n\nfunc openCookieV0Bytes(body []byte, masterCookieKey []byte, aad []byte, now time.Time) (*CookieEnvelope, error) {\n\tkey, err := deriveKey(masterCookieKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/challenge/crypto.go#L182-L218","documentation":"Base64url decoding of the sealed challenge cookie failed. ErrCookieMalformed is wrapped with the base64 decoder's reason: the cookie presented by the client is not valid base64 (truncated, mangled by a proxy, or hand-crafted). Treated like any invalid cookie — the client is simply re-challenged.","triggerScenarios":"Thrown at pkg/appsec/challenge/crypto.go:200 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["No server-side fix for one-off bad cookies; clients get a fresh challenge","If it affects all clients, check for proxies/CDNs rewriting or truncating Cookie headers","Verify the cookie is not exceeding size limits upstream (the ErrCookieTooLarge path)"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}