crowdsecurity/crowdsec · warning

cookie exceeds maximum size

Error message

cookie exceeds maximum size

What it means

ErrCookieTooLarge means the serialized challenge cookie would exceed the configured maximum cookie length. sealCookieV0 checks the plaintext (fixed header + reason + allowlist envelope) against the budget derived from maxCookieLen, and openCookie rejects base64-encoded values whose length exceeds maxCookieLen. This protects browsers and intermediaries that reject oversized Set-Cookie headers.

Source

Thrown at pkg/appsec/challenge/crypto.go:34

	"encoding/binary"
	"errors"
	"fmt"
	"time"

	"golang.org/x/crypto/hkdf"

	"github.com/crowdsecurity/crowdsec/pkg/appsec/challenge/pb"
	"google.golang.org/protobuf/proto"
)

var (
	ErrCookieMalformed     = errors.New("malformed cookie")
	ErrCookieSignature     = errors.New("invalid cookie signature")
	ErrCookiePayload       = errors.New("invalid cookie payload")
	ErrCookieExpired       = errors.New("cookie expired")
	ErrCookieVersion       = errors.New("unknown cookie version")
	ErrAllowlistReasonSize = errors.New("allowlist reason exceeds maximum length")
	ErrCookieTooLarge      = errors.New("cookie exceeds maximum size")
)

const hkdfInfo = "crowdsec-challenge-cookie"

// MaxAllowlistReasonLen caps the reason string operators pass to
// GrantChallengeCookie. The reason travels inside every Set-Cookie + Cookie
// header round-trip until the cookie expires; bounding it keeps the cookie
// well under the 4 KB browser limit even with the AES-GCM tag + base64
// expansion.
const MaxAllowlistReasonLen = 256

// MaxCookieLen is the DEFAULT per-cookie size (RFC 6265 §6.1: 4096 bytes).
// Can be configured via Config.MaxCookieSize and we reject anything bigger.
const MaxCookieLen = 4096

// Cookie wire format. A single version byte at offset 0 lets us evolve the
// format without flag-day-style cookie invalidation. New formats add a new
// case in openCookie's switch.

View on GitHub (pinned to 909b515798)

Solutions

1. Reduce the embedded data: shorten the allowlist reason or trim envelope entries.
2. Raise the configured maxCookieLen (it is configurable — see TestCookieV0_ConfigurableLimit), keeping browser ~4KB header limits in mind.
3. If the presented cookie is oversized relative to config, confirm all nodes use the same maxCookieLen; issue a fresh cookie.
4. Check for clients sending concatenated/duplicated cookie values through proxy rewriting.

Example fix

// before: sealing with a huge reason inside the envelope
sealCookieV0(c, key, notAfter, flag, giantReason, ua, maxCookieLen)
// after: cap or reject early
if len(giantReason) > challenge.MaxAllowlistReasonLen {
    return fmt.Errorf("reason too long")
}
sealCookieV0(c, key, notAfter, flag, giantReason, ua, maxCookieLen)

// estimate before sealing: fixed header + reason + envelope vs budget
budget := (maxCookieLen*3/4) - 1 - 16 /*nonce*/ - 16 /*gcm tag*/
if cookiePlaintextFixedHeaderLen+len(reason)+estimatedEnvelope > budget {
    return errors.New("cookie payload would exceed maxCookieLen")
}

encoded, err := sealCookieV0(c, key, notAfter, flag, reason, ua, maxLen)
if errors.Is(err, challenge.ErrCookieTooLarge) {
    // shrink payload or raise maxCookieLen, then retry once
    encoded, err = sealCookieV0(c, key, notAfter, flag, truncate(reason), ua, maxLen)
}
return err

When it happens

Trigger: sealCookieV0: plaintext size (cookiePlaintextFixedHeaderLen + reason + protobuf envelope) exceeds maxCookieLen/4*3-1-nonce-overhead (crypto.go:135). openCookie: base64 length of the presented value exceeds maxCookieLen (crypto.go:195). Exercised by TestCookieV0_SealEnvelopeTooLarge, TestCookieV0_OpenValueTooLarge, TestCookieV0_ConfigurableLimit.

Common situations: Very long allowlist reasons or large allowlist metadata inflate the envelope; a client sends a cookie value larger than the configured limit (possibly issued under a larger maxCookieLen config); misconfigured maxCookieLen that is too small for the payload.

Understand the failure class

Background: payload too large / request exceeds maximum size: why libraries cap bytes and how to fix oversize payloads — this error's family across 50 libraries.

Related errors

• ErrCookieTooLarge
• allowlist reason exceeds maximum length
• invalid challenge cookie: %w
• ErrAllowlistReasonSize
• invalid schema name

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e64be18800343a6e. Report an issue: GitHub.