crowdsecurity/crowdsec · error

appsec datasource requires a lapi client configuration. this

Error message

appsec datasource requires a lapi client configuration. this is a bug, please report

What it means

Configure() also requires a pre-populated lapiClientConfig (the LAPI client credentials/config injected during datasource common setup). A nil value means the appsec Source was constructed without its required state. Like the hub check, this is flagged as an internal bug rather than a user-facing config error.

Source

Thrown at pkg/acquisition/modules/appsec/config.go:193

			if _, ok := seen[name]; ok {
				continue
			}

			seen[name] = struct{}{}
			toLoad = append(toLoad, name)
		}
	}

	return toLoad, nil
}

func (w *Source) Configure(ctx context.Context, yamlConfig []byte, logger *log.Entry, _ metrics.AcquisitionMetricsLevel) error {
	if w.hub == nil {
		return errors.New("appsec datasource requires a hub. this is a bug, please report")
	}

	if w.lapiClientConfig == nil {
		return errors.New("appsec datasource requires a lapi client configuration. this is a bug, please report")
	}

	if err := w.UnmarshalConfig(yamlConfig); err != nil {
		return fmt.Errorf("unable to parse appsec configuration: %w", err)
	}

	if w.lapiClientConfig.Credentials == nil {
		return errors.New("missing lapi client credentials")
	}

	w.lapiURL = fmt.Sprintf("%sv1/decisions/stream", w.lapiClientConfig.Credentials.URL)
	w.AuthCache = NewAuthCache()

	w.logger = logger
	w.logger.Tracef("Appsec configuration: %+v", w.config)

	if w.config.AuthCacheDuration == nil {
		w.config.AuthCacheDuration = &DefaultAuthCacheDuration

View on GitHub (pinned to 909b515798)

Solutions

1. Report the bug to CrowdSec with logs
2. If embedding, initialize the Source's common state (lapiClientConfig) before calling Configure()
3. Rebuild/reinstall the appsec plugin binaries together with crowdsec (make build) to keep versions in sync

Example fix

// before
src := &appsec.Source{}
err := src.Configure(ctx, yaml, logger, metrics)
// after
src := &appsec.Source{}
src.ConfigureCommonState(state) // populates lapiClientConfig
err := src.Configure(ctx, yaml, logger, metrics)

if src.lapiClientConfig == nil { return errors.New("lapi client config not initialized") }

func lapiConfigReady(s *appsec.Source) bool { return s != nil && s.LapiClientConfig != nil }

if err := src.Configure(ctx, cfg, logger, lvl); err != nil {
    if strings.Contains(err.Error(), "lapi client configuration") { /* re-init common state */ }
    return err
}

When it happens

Trigger: appsec Source.Configure() invoked with w.lapiClientConfig == nil, i.e. the constructor/common-state initialization that wires LAPI client configuration was skipped or failed silently.

Common situations: Embedding the appsec datasource in a custom binary, running a stale or custom-built appsec plugin binary that no longer matches the main crowdsec initialization sequence, or plugin startup ordering issues.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• appsec datasource requires a hub. this is a bug, please repo
• missing lapi client credentials
• client not initialized
• controller init: %w
• failed to generate initial challenge bundle: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/d43bbb995b90defc. Report an issue: GitHub.