crowdsecurity/crowdsec · error

ErrChallengePoW

ErrChallengePoW

Error message

invalid proof-of-work in challenge response

What it means

Sentinel error ErrChallengePoW: SHA256(powSalt + nonce) submitted by the client does not have the required number of leading zero bits, so the proof-of-work was not actually computed. Mapped to the 'pow' failure reason in appsec metrics; indicates a client that skipped the JS worker or forged the submission.

Source

Thrown at pkg/appsec/challenge/challenge.go:62

	"golang.org/x/sys/cpu"
)

// Internal URL paths the challenge runtime intercepts. Bouncers MUST forward
// these to the WAF unmodified; they are served by the appsec dispatcher
// (pkg/appsec/appsec.go) rather than by the protected origin.
const (
	ChallengeJSPath        = "/crowdsec-internal/challenge/challenge.js"
	ChallengeSubmitPath    = "/crowdsec-internal/challenge/submit"
	ChallengePowWorkerPath = "/crowdsec-internal/challenge/pow-worker.js"
	ChallengeFPScannerPath = "/crowdsec-internal/challenge/fpscanner.js"
)

// Sentinel errors (reasons) returned by ValidateChallengeResponse.
var (
	ErrChallengeFields     = errors.New("missing required fields in challenge response")
	ErrChallengeTicket     = errors.New("invalid ticket in challenge response")
	ErrChallengeDifficulty = errors.New("challenge difficulty is impossible")
	ErrChallengePoW        = errors.New("invalid proof-of-work in challenge response")
	ErrChallengeHMAC       = errors.New("invalid HMAC in challenge response")
	ErrChallengePayload    = errors.New("invalid challenge response payload")
)

// ChallengeCookieName is the name of the sealed cookie carrying the
// successfully-validated fingerprint between requests.
const ChallengeCookieName = "__crowdsec_challenge"

// cryptoObfuscationPoolDefaultSize is how many obfuscations of the per-epoch
// key module to keep per live epoch. Each variant embeds the same key
// differently (per-visitor byte variance); default 1 keeps prior behavior.
const cryptoObfuscationPoolDefaultSize = 1

// defaultCookieTTL is the default challenge-cookie validity. Decoupled from the
// keyring window (enforced by not_after in the envelope), so cookies can
// outlive the per-epoch signing window without widening forgery exposure.
const defaultCookieTTL = 12 * time.Hour

View on GitHub (pinned to 909b515798)

Solutions

1. Deny or re-challenge the request per appsec remediation settings
2. Ensure browsers execute the challenge JS (pow-worker.js) — check for JS-disabled clients or broken bouncer header forwarding

When it happens

Trigger: Thrown at pkg/appsec/challenge/challenge.go:62 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c94d26a5eef4688d. Report an issue: GitHub.