{"record":{"id":"5a5943e04f687d81","repo":"crowdsecurity/crowdsec","slug":"multiple-cookies-with-name-s-found","errorCode":null,"errorMessage":"multiple cookies with name %s found","messagePattern":"multiple cookies with name (.+?) found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":276,"sourceCode":"\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"header\":\n\t\t\t\tcanonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[canonicalHeaderName]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"header %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple headers with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"cookie\":\n\t\t\t\tcookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)\n\t\t\t\tif len(cookieValues) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"cookie %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(cookieValues) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple cookies with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = cookieValues[0].Value\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"unsupported apiKey location %s\", input.SecurityScheme.In)\n\t\t\t}\n\t\tcase \"oauth2\", \"openIdConnect\":\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"%s security scheme not supported\", input.SecurityScheme.Type)\n\t\tdefault:\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"unsupported security scheme type %s\", input.SecurityScheme.Type)\n\t\t}\n\t\tif authTokenValue == \"\" {\n\t\t\treturn errors.New(\"auth token is required but not provided\")","sourceCodeStart":258,"sourceCodeEnd":294,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L258-L294","documentation":"While resolving an apiKey security scheme located in a cookie, CookiesNamed returned more than one cookie with the scheme's name. Duplicate cookies make the token ambiguous, so the request fails the security requirement instead of picking arbitrarily.","triggerScenarios":"CookiesNamed(input.SecurityScheme.Name) returns more than one cookie at pkg/appsec/api_validation/api_validation.go:276.","commonSituations":"Cookies set on different paths/domains both matching the request (e.g. a stale cookie at / and a new one at /app); apps re-issuing cookies without clearing the old one.","solutions":["Clear duplicate cookies so only one cookie with the required name is sent.","Fix the server/app to set cookies with a consistent Path/Domain so they overwrite rather than coexist.","Delete stale cookies from the client or use a cookie jar that replaces same-name cookies."],"exampleFix":"// before: setting same cookie on two paths\nhttp.SetCookie(w, &http.Cookie{Name: \"session\", Value: v, Path: \"/\"})\nhttp.SetCookie(w, &http.Cookie{Name: \"session\", Value: v, Path: \"/app\"})\n// after\nhttp.SetCookie(w, &http.Cookie{Name: \"session\", Value: v, Path: \"/\"})","handlingStrategy":"validation","validationCode":"if len(req.CookiesNamed(\"session\")) != 1 { return errors.New(\"exactly one session cookie expected\") }","typeGuard":null,"tryCatchPattern":"err := validator.ValidateRequest(input); if err != nil { if strings.Contains(err.Error(), \"multiple cookies\") { return ErrDuplicateCookie } return err }","preventionTips":["Set cookies with a single consistent Path/Domain so they overwrite","Clear old cookies when re-issuing credentials","Use a cookie jar that dedupes by name per domain"],"tags":["appsec","openapi","api-key","cookie","duplicate"],"backgroundTag":"invalid-query-parameter","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}