{"record":{"id":"913f51bf6d12a81a","repo":"crowdsecurity/crowdsec","slug":"grantchallengecookie-ttl-must-be-positive-got-s","errorCode":null,"errorMessage":"GrantChallengeCookie TTL must be positive, got %s","messagePattern":"GrantChallengeCookie TTL must be positive, got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/waf_helpers.go","lineNumber":65,"sourceCode":"// parsed with time.ParseDuration (e.g. \"1h\", \"30m\"). More than one TTL\n// argument or an unparseable value is reported as an error so hook authors\n// get a precise diagnostic at evaluation time rather than a silent fallback.\nfunc parseChallengeCookieTTLArg(ttl []string) (*time.Duration, error) {\n\tif len(ttl) == 0 {\n\t\treturn nil, nil\n\t}\n\tif len(ttl) > 1 {\n\t\treturn nil, fmt.Errorf(\"GrantChallengeCookie accepts at most one TTL argument, got %d\", len(ttl))\n\t}\n\tif ttl[0] == \"\" {\n\t\treturn nil, nil\n\t}\n\td, err := time.ParseDuration(ttl[0])\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid GrantChallengeCookie TTL %q: %w\", ttl[0], err)\n\t}\n\tif d <= 0 {\n\t\treturn nil, fmt.Errorf(\"GrantChallengeCookie TTL must be positive, got %s\", d)\n\t}\n\treturn &d, nil\n}\n\nfunc GetOnLoadEnv(w *AppsecRuntimeConfig) map[string]interface{} {\n\treturn map[string]interface{}{\n\t\t\"RemoveInBandRuleByID\":         w.DisableInBandRuleByID,\n\t\t\"RemoveInBandRuleByTag\":        w.DisableInBandRuleByTag,\n\t\t\"RemoveInBandRuleByName\":       w.DisableInBandRuleByName,\n\t\t\"RemoveOutBandRuleByID\":        w.DisableOutBandRuleByID,\n\t\t\"RemoveOutBandRuleByTag\":       w.DisableOutBandRuleByTag,\n\t\t\"RemoveOutBandRuleByName\":      w.DisableOutBandRuleByName,\n\t\t\"SetRemediationByTag\":          w.SetActionByTag,\n\t\t\"SetRemediationByID\":           w.SetActionByID,\n\t\t\"SetRemediationByName\":         w.SetActionByName,\n\t\t\"SetChallengeDifficulty\":       w.SetChallengeDifficulty,\n\t\t\"LoadAPISchemaWithName\":        w.LoadAPISchemaWithName,\n\t\t\"LoadAPISchemaWithOptions\":     w.LoadAPISchemaWithOptions,","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/waf_helpers.go#L47-L83","documentation":"The GrantChallengeCookie TTL argument parsed successfully but is zero or negative. A non-positive TTL would create a cookie that is expired on arrival, so it is rejected outright with the offending value shown.","triggerScenarios":"Thrown at pkg/appsec/waf_helpers.go:65 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass a positive duration such as \"1h\", or omit the argument to use the runtime default TTL"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}