{"record":{"id":"6b6da8cd5b3c2113","repo":"crowdsecurity/crowdsec","slug":"while-setting-trusted-proxies-w","errorCode":null,"errorMessage":"while setting trusted_proxies: %w","messagePattern":"while setting trusted_proxies: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/apiserver.go","lineNumber":154,"sourceCode":"\n\tif !log.IsLevelEnabled(log.DebugLevel) {\n\t\tgin.SetMode(gin.ReleaseMode)\n\t}\n\n\trouter := gin.New()\n\n\trouter.ForwardedByClientIP = false\n\n\t// set the remore address of the request to 127.0.0.1 if it comes from a unix socket\n\trouter.Use(func(c *gin.Context) {\n\t\tif c.Request.RemoteAddr == \"@\" {\n\t\t\tc.Request.RemoteAddr = \"127.0.0.1:65535\"\n\t\t}\n\t})\n\n\tif config.TrustedProxies != nil && config.UseForwardedForHeaders {\n\t\tif err = router.SetTrustedProxies(*config.TrustedProxies); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"while setting trusted_proxies: %w\", err)\n\t\t}\n\n\t\trouter.ForwardedByClientIP = true\n\t}\n\n\tgin.DefaultErrorWriter = accessLogger.WriterLevel(log.ErrorLevel)\n\tgin.DefaultWriter = accessLogger.Writer()\n\n\trouter.Use(gin.LoggerWithFormatter(func(param gin.LogFormatterParams) string {\n\t\treturn fmt.Sprintf(\"%s - [%s] \\\"%s %s %s %d %s %q %s\\\"\\n\",\n\t\t\tparam.ClientIP,\n\t\t\tparam.TimeStamp.Format(time.RFC1123),\n\t\t\tparam.Method,\n\t\t\tparam.Path,\n\t\t\tparam.Request.Proto,\n\t\t\tparam.StatusCode,\n\t\t\tparam.Latency,\n\t\t\tparam.Request.UserAgent(),","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/apiserver.go#L136-L172","documentation":"NewServer wraps the error from gin's router.SetTrustedProxies when the trusted_proxies list cannot be applied. Gin returns this when any entry is not a valid IP address or CIDR network. The server is not created.","triggerScenarios":"NewServer called with config.TrustedProxies set and UseForwardedForHeaders true, and at least one element of the trusted_proxies YAML list fails gin's parse (not an IP/CIDR, or an invalid value like a hostname).","commonSituations":"Typo in api.server.trusted_proxies (e.g. '10.0.0.0/8x', 'proxy.example.com'); copying an nginx-style hostname into the list; trailing whitespace/yaml quoting issues.","solutions":["Check the trusted_proxies entries in your lapi config: each must be a valid IP or CIDR.","Remove or fix the offending entry (run crowdsec in debug to see which one gin rejected).","Use hostnames via gin's SetTrustedProxies alternative only if your gin version supports them — here it expects IP/CIDR only.","If you don't terminate TLS/HTTP behind a proxy, delete the trusted_proxies key entirely."],"exampleFix":"// before\napi:\n  server:\n    trusted_proxies:\n      - proxy.internal.example.com\n// after\napi:\n  server:\n    trusted_proxies:\n      - 10.0.0.0/8\n      - 127.0.0.1","handlingStrategy":"validation","validationCode":"// validate trusted proxies before NewServer\nfor _, p := range cfg.TrustedProxies {\n    if net.ParseIP(p) == nil && _, _, err := net.ParseCIDR(p); err != nil {\n        return fmt.Errorf(\"trusted_proxies entry %q is not an IP or CIDR\", p)\n    }\n}","typeGuard":null,"tryCatchPattern":"srv, err := NewServer(ctx, cfg, nil)\nif err != nil && strings.Contains(err.Error(), \"while setting trusted_proxies\") {\n    log.Fatalf(\"fix api.server.trusted_proxies entries: %v\", err)\n}","preventionTips":["Only put IP/CIDR strings in trusted_proxies — never hostnames.","Lint the LAPI YAML in CI with a schema check.","Test proxy config in staging behind the real reverse proxy."],"tags":["gin","configuration","network"],"backgroundTag":"invalid-config-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}