caddyserver/caddy · error

parsing duration: input string too long

Error message

parsing duration: input string too long

What it means

ParseDuration rejects any duration string longer than 1024 characters before attempting to parse. This is a cheap DoS guard for untrusted input (the parser is hand-written and O(n) over a potentially huge string). The 'd' (days) unit is a Caddy extension over time.ParseDuration.

Source

Thrown at caddy.go:892

	}
	var dur time.Duration
	var err error
	if b[0] == byte('"') && b[len(b)-1] == byte('"') {
		dur, err = ParseDuration(strings.Trim(string(b), `"`))
	} else {
		err = json.Unmarshal(b, &dur)
	}
	*d = Duration(dur)
	return err
}

// ParseDuration parses a duration string, adding
// support for the "d" unit meaning number of days,
// where a day is assumed to be 24h. The maximum
// input string length is 1024.
func ParseDuration(s string) (time.Duration, error) {
	if len(s) > 1024 {
		return 0, fmt.Errorf("parsing duration: input string too long")
	}
	var inNumber bool
	var numStart int
	for i := 0; i < len(s); i++ {
		ch := s[i]
		if ch == 'd' {
			daysStr := s[numStart:i]
			days, err := strconv.ParseFloat(daysStr, 64)
			if err != nil {
				return 0, err
			}
			hours := days * 24.0
			hoursStr := strconv.FormatFloat(hours, 'f', -1, 64)
			s = s[:numStart] + hoursStr + "h" + s[i+1:]
			i--
			continue
		}
		if !inNumber {

View on GitHub (pinned to 50e54ee279)

Solutions

1. Find the offending duration field: the error appears during JSON unmarshal or Caddyfile parsing of a duration-typed field
2. Shorten the value to a sane duration using larger units (e.g. '8760h' or '365d' instead of repeated hours)
3. If generating durations programmatically, format with time.Duration.String() which never exceeds ~20 chars
4. For user-facing APIs, validate length before passing to ParseDuration

Example fix

// before
dur, err := caddy.ParseDuration(userSuppliedMaybeHugeString)
// after
if len(userSuppliedMaybeHugeString) > 1024 {
    return fmt.Errorf("duration too long")
}
dur, err := caddy.ParseDuration(userSuppliedMaybeHugeString)

func parseDurationSafe(s string) (time.Duration, error) {
    if len(s) > 1024 {
        return 0, fmt.Errorf("duration string too long (%d bytes)", len(s))
    }
    return caddy.ParseDuration(s)
}

When it happens

Trigger: Calling caddy.ParseDuration (directly or via Duration.UnmarshalJSON, which routes strings through it) with a string longer than 1024 bytes. Any Caddyfile/JSON field typed as a duration that receives a giant value hits this.

Common situations: A config templating bug that repeats a unit many times (e.g. '1s' concatenated thousands of times), or adversarial input to an API that accepts duration strings. Normal configs never approach the limit.

Related errors

• parsing key: %v

AI-assisted analysis of caddyserver/caddy@50e54ee279 (2026-08-15). Data as JSON: /api/errors/5b622d8be25b9558. Report an issue: GitHub.