{"record":{"id":"c2faffaa8d797946","repo":"crowdsecurity/crowdsec","slug":"missing-allowed-ranges-value-for-api-server-auto-r","errorCode":null,"errorMessage":"missing allowed_ranges value for api.server.auto_register","messagePattern":"missing allowed_ranges value for api\\.server\\.auto_register","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csconfig/api.go","lineNumber":547,"sourceCode":"\t// Disable by default\n\tif c.AutoRegister.Enable == nil {\n\t\tc.AutoRegister.Enable = new(false)\n\t}\n\n\tif !*c.AutoRegister.Enable {\n\t\treturn nil\n\t}\n\n\tif c.AutoRegister.Token == \"\" {\n\t\treturn errors.New(\"missing token value for api.server.auto_register\")\n\t}\n\n\tif len(c.AutoRegister.Token) < 32 {\n\t\treturn errors.New(\"token value for api.server.auto_register is too short (min 32 characters)\")\n\t}\n\n\tif c.AutoRegister.AllowedRanges == nil {\n\t\treturn errors.New(\"missing allowed_ranges value for api.server.auto_register\")\n\t}\n\n\tc.AutoRegister.AllowedRangesParsed = make([]*net.IPNet, 0, len(c.AutoRegister.AllowedRanges))\n\n\tfor _, ipRange := range c.AutoRegister.AllowedRanges {\n\t\t_, ipNet, err := net.ParseCIDR(ipRange)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"auto_register: failed to parse allowed range '%s': %w\", ipRange, err)\n\t\t}\n\n\t\tc.AutoRegister.AllowedRangesParsed = append(c.AutoRegister.AllowedRangesParsed, ipNet)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":529,"sourceCodeEnd":563,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csconfig/api.go#L529-L563","documentation":"LoadAutoRegister requires an allowed_ranges list when auto_register is enabled: it defines the CIDR ranges from which agents may auto-enroll. A missing (nil) allowed_ranges value aborts config load; each entry is then parsed as CIDR into AllowedRangesParsed.","triggerScenarios":"api.server.auto_register.enable: true with api.server.auto_register.allowed_ranges absent (nil); LocalApiServerCfg.LoadAutoRegister() hits the nil check during LAPI config load.","commonSituations":"Enabling auto_register without thinking about which networks are trusted; templated configs that only set enable and token; docs examples that omit allowed_ranges.","solutions":["Add allowed_ranges listing trusted CIDRs, e.g. ['192.168.0.0/16','10.0.0.0/8']","Restrict ranges to the networks where agents actually run","Disable auto_register if agent auto-enrollment is not needed"],"exampleFix":"// before\nauto_register:\n  enable: true\n  token: \"e3b0c44298fc1c149afbf4c8996fb924\"\n// after\nauto_register:\n  enable: true\n  token: \"e3b0c44298fc1c149afbf4c8996fb924\"\n  allowed_ranges:\n    - 10.0.0.0/8\n    - 192.168.0.0/16","handlingStrategy":"validation","validationCode":"if cfg.AutoRegister != nil && cfg.AutoRegister.Enable != nil && *cfg.AutoRegister.Enable && len(cfg.AutoRegister.AllowedRanges) == 0 {\n    return errors.New(\"auto_register enabled without allowed_ranges\")\n}\nfor _, r := range cfg.AutoRegister.AllowedRanges {\n    if _, _, err := net.ParseCIDR(r); err != nil { return err }\n}","typeGuard":null,"tryCatchPattern":"if err := serverCfg.LoadAutoRegister(); err != nil {\n    return fmt.Errorf(\"auto_register config: %w\", err)\n}","preventionTips":["Always pair enable: true with an explicit allowed_ranges list","Use tight CIDRs limited to trusted agent networks","Pre-validate each entry with net.ParseCIDR in config linting"],"tags":["go","config","lapi","auto-register","cidr"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}