{"record":{"id":"e13cc2cfe18a24bc","repo":"crowdsecurity/crowdsec","slug":"token-value-for-api-server-auto-register-is-too-sh","errorCode":null,"errorMessage":"token value for api.server.auto_register is too short (min 32 characters)","messagePattern":"token value for api\\.server\\.auto_register is too short \\(min 32 characters\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csconfig/api.go","lineNumber":543,"sourceCode":"\n\t\treturn nil\n\t}\n\n\t// Disable by default\n\tif c.AutoRegister.Enable == nil {\n\t\tc.AutoRegister.Enable = new(false)\n\t}\n\n\tif !*c.AutoRegister.Enable {\n\t\treturn nil\n\t}\n\n\tif c.AutoRegister.Token == \"\" {\n\t\treturn errors.New(\"missing token value for api.server.auto_register\")\n\t}\n\n\tif len(c.AutoRegister.Token) < 32 {\n\t\treturn errors.New(\"token value for api.server.auto_register is too short (min 32 characters)\")\n\t}\n\n\tif c.AutoRegister.AllowedRanges == nil {\n\t\treturn errors.New(\"missing allowed_ranges value for api.server.auto_register\")\n\t}\n\n\tc.AutoRegister.AllowedRangesParsed = make([]*net.IPNet, 0, len(c.AutoRegister.AllowedRanges))\n\n\tfor _, ipRange := range c.AutoRegister.AllowedRanges {\n\t\t_, ipNet, err := net.ParseCIDR(ipRange)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"auto_register: failed to parse allowed range '%s': %w\", ipRange, err)\n\t\t}\n\n\t\tc.AutoRegister.AllowedRangesParsed = append(c.AutoRegister.AllowedRangesParsed, ipNet)\n\t}\n\n\treturn nil","sourceCodeStart":525,"sourceCodeEnd":561,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csconfig/api.go#L525-L561","documentation":"LoadAutoRegister additionally enforces a minimum length of 32 characters for the auto_register token, since it is used as a security credential for agent enrollment. Tokens shorter than 32 characters are rejected as too weak.","triggerScenarios":"api.server.auto_register.enable: true with a token string of length 1-31; LocalApiServerCfg.LoadAutoRegister() length check fails during config load.","commonSituations":"Manually invented short tokens ('mytoken', 16-char UUIDs); users unaware of the documented minimum; truncated tokens produced by templating or copy-paste.","solutions":["Use a token of at least 32 characters, e.g. `openssl rand -hex 16` output","Pad/replace the existing short token in api.server.auto_register.token","If you cannot generate one, reuse an existing enrollment token of adequate length"],"exampleFix":"// before\nauto_register:\n  enable: true\n  token: \"short-token\"\n// after\nauto_register:\n  enable: true\n  token: \"e3b0c44298fc1c149afbf4c8996fb924\"","handlingStrategy":"validation","validationCode":"if len(cfg.AutoRegister.Token) < 32 {\n    return errors.New(\"auto_register token must be at least 32 characters\")\n}","typeGuard":null,"tryCatchPattern":"if err := serverCfg.LoadAutoRegister(); err != nil {\n    return fmt.Errorf(\"auto_register config: %w\", err)\n}","preventionTips":["Always generate tokens of 32+ random hex characters","Check token length after templating to catch truncation","Document the 32-char minimum wherever auto_register is configured"],"tags":["go","config","security","token"],"backgroundTag":"value-out-of-range","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}