crowdsecurity/crowdsec · error

ErrCookieMalformed

ErrCookieMalformed

Error message

%w: failed to decode: %w

What it means

Base64url decoding of the sealed challenge cookie failed. ErrCookieMalformed is wrapped with the base64 decoder's reason: the cookie presented by the client is not valid base64 (truncated, mangled by a proxy, or hand-crafted). Treated like any invalid cookie — the client is simply re-challenged.

Source

Thrown at pkg/appsec/challenge/crypto.go:200

	AllowlistReason string
	NotAfter        int64
}

// openCookie decodes a sealed cookie, dispatching on the version byte.
// Unknown versions are rejected with ErrCookieVersion. Expired cookies
// (notAfter <= now) are rejected with ErrCookieExpired.
func openCookie(encoded string, masterCookieKey []byte, aad []byte, maxCookieLen int) (*CookieEnvelope, error) {
	if maxCookieLen <= 0 {
		maxCookieLen = MaxCookieLen
	}

	if len(encoded) > maxCookieLen {
		return nil, fmt.Errorf("%w: %d > %d", ErrCookieTooLarge, len(encoded), maxCookieLen)
	}

	raw, err := base64.RawURLEncoding.DecodeString(encoded)
	if err != nil {
		return nil, fmt.Errorf("%w: failed to decode: %w", ErrCookieMalformed, err)
	}
	if len(raw) < 1 {
		return nil, fmt.Errorf("%w: empty cookie", ErrCookieMalformed)
	}

	switch raw[0] {
	case cookieVersionV0:
		return openCookieV0Bytes(raw[1:], masterCookieKey, aad, time.Now())
	default:
		return nil, fmt.Errorf("%w: 0x%02x", ErrCookieVersion, raw[0])
	}
}

func openCookieV0Bytes(body []byte, masterCookieKey []byte, aad []byte, now time.Time) (*CookieEnvelope, error) {
	key, err := deriveKey(masterCookieKey)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 909b515798)

Solutions

1. No server-side fix for one-off bad cookies; clients get a fresh challenge
2. If it affects all clients, check for proxies/CDNs rewriting or truncating Cookie headers
3. Verify the cookie is not exceeding size limits upstream (the ErrCookieTooLarge path)

When it happens

Trigger: Thrown at pkg/appsec/challenge/crypto.go:200 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/365b0f0ff5dfc2d7. Report an issue: GitHub.