{"record":{"id":"4b19df08aa10826b","repo":"crowdsecurity/crowdsec","slug":"invalid-challenge-master-secret-w","errorCode":null,"errorMessage":"invalid challenge master_secret: %w","messagePattern":"invalid challenge master_secret: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/challenge/config.go","lineNumber":127,"sourceCode":"\tif parent != nil {\n\t\tbase = parent.Logger\n\t}\n\n\tvar lvl log.Level\n\tif c != nil && c.LogLevel != nil {\n\t\tlvl = *c.LogLevel\n\t}\n\n\topts := []Option{WithLogger(logging.SubLogger(base, \"challenge\", lvl))}\n\n\tif c == nil {\n\t\treturn opts, nil\n\t}\n\n\tif c.MasterSecret != nil && *c.MasterSecret != \"\" {\n\t\tsecret, err := ParseConfiguredSecret(*c.MasterSecret)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"invalid challenge master_secret: %w\", err)\n\t\t}\n\t\topts = append(opts, WithMasterSecret(secret))\n\t}\n\tif c.KeyRotationInterval != nil {\n\t\topts = append(opts, WithRotationInterval(*c.KeyRotationInterval))\n\t}\n\tif c.MaxLiveEpochs != nil && *c.MaxLiveEpochs > 0 {\n\t\topts = append(opts, WithMaxLiveEpochs(*c.MaxLiveEpochs))\n\t}\n\tif c.CookieTTL != nil {\n\t\topts = append(opts, WithCookieTTL(*c.CookieTTL))\n\t}\n\tif c.MaxCookieSize != nil && *c.MaxCookieSize > 0 {\n\t\topts = append(opts, WithMaxCookieLen(*c.MaxCookieSize))\n\t}\n\tif c.CryptoObfuscationPoolSize != nil && *c.CryptoObfuscationPoolSize > 0 {\n\t\topts = append(opts, WithCryptoObfuscationPoolSize(*c.CryptoObfuscationPoolSize))\n\t}","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/challenge/config.go#L109-L145","documentation":"BuildOptions translates the YAML challenge Config into runtime options. This error means the configured master_secret failed ParseConfiguredSecret validation: it is empty, is a hex string that decodes to fewer than 32 bytes, or is a passphrase shorter than 32 bytes. The runtime refuses to start with a weak or unparseable secret rather than silently padding it.","triggerScenarios":"Calling challenge.BuildOptions with a Config whose MasterSecret is non-empty but rejected by ParseConfiguredSecret — e.g. a short hex string, a short passphrase, or a value with invalid characters that still trips the hex-length check.","commonSituations":"Operators setting master_secret to a short human password in appsec config YAML; generating a hex secret with too few bytes (e.g. 16 random bytes = 32 hex chars, still under the 32-byte minimum); typos or truncation when copying the secret between fleet nodes.","solutions":["Generate a sufficiently long secret: `openssl rand -hex 32` (64 hex chars = 32 bytes) and set it as master_secret.","If using a passphrase, ensure it is at least 32 characters long.","Verify all fleet nodes use the exact same master_secret value.","Check the wrapped error message: it states whether the hex decode length or passphrase length is below the 32-byte minimum."],"exampleFix":"# before (too short: 32 hex chars = 16 bytes)\nmaster_secret: a3f1b2c4d5e6f7089a1b2c3d4e5f6071\n# after (64 hex chars = 32 bytes)\nmaster_secret: $(openssl rand -hex 32)","handlingStrategy":"validation","validationCode":"secret, err := challenge.ParseConfiguredSecret(cfg.MasterSecret)\nif err != nil {\n    return fmt.Errorf(\"master_secret: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"opts, err := challenge.BuildOptions(cfg, logger)\nif err != nil {\n    return fmt.Errorf(\"challenge configuration invalid: %w\", err)\n}","preventionTips":["Generate secrets with `openssl rand -hex 32` (minimum 32 bytes).","Never use short human passwords as master_secret.","Deploy the same secret to every node via a secret manager.","Validate config at startup with BuildOptions before serving traffic."],"tags":["appsec","config","secret","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}