{"record":{"id":"89f843575d495aaa","repo":"crowdsecurity/crowdsec","slug":"errcookieversion","errorCode":"ErrCookieVersion","errorMessage":"%w: 0x%02x","messagePattern":"%w: 0x%02x","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/challenge/crypto.go","lineNumber":210,"sourceCode":"\t}\n\n\tif len(encoded) > maxCookieLen {\n\t\treturn nil, fmt.Errorf(\"%w: %d > %d\", ErrCookieTooLarge, len(encoded), maxCookieLen)\n\t}\n\n\traw, err := base64.RawURLEncoding.DecodeString(encoded)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"%w: failed to decode: %w\", ErrCookieMalformed, err)\n\t}\n\tif len(raw) < 1 {\n\t\treturn nil, fmt.Errorf(\"%w: empty cookie\", ErrCookieMalformed)\n\t}\n\n\tswitch raw[0] {\n\tcase cookieVersionV0:\n\t\treturn openCookieV0Bytes(raw[1:], masterCookieKey, aad, time.Now())\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"%w: 0x%02x\", ErrCookieVersion, raw[0])\n\t}\n}\n\nfunc openCookieV0Bytes(body []byte, masterCookieKey []byte, aad []byte, now time.Time) (*CookieEnvelope, error) {\n\tkey, err := deriveKey(masterCookieKey)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tblock, err := aes.NewCipher(key)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create cipher: %w\", err)\n\t}\n\n\tgcm, err := cipher.NewGCM(block)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to create GCM: %w\", err)\n\t}","sourceCodeStart":192,"sourceCodeEnd":228,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/challenge/crypto.go#L192-L228","documentation":"The first byte of a decoded challenge cookie is not a known envelope version (only cookieVersionV0 exists). ErrCookieVersion is wrapped with the offending version byte in hex. This is expected when a cookie issued by a future/other deployment (or garbage) is presented; the client is re-challenged rather than trusted.","triggerScenarios":"Thrown at pkg/appsec/challenge/crypto.go:210 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Usually benign: stale cookies from an older/newer crowdsec deployment are rejected and re-issued","If persistent after an upgrade, let the old cookies expire or clear them client-side","Verify all nodes behind the bouncer run a compatible cookie version"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}