crowdsecurity/crowdsec · error

GrantChallengeCookie accepts at most one TTL argument, got %

Error message

GrantChallengeCookie accepts at most one TTL argument, got %d

What it means

The GrantChallengeCookie expr helper was called from a hook with more than one TTL argument. The helper accepts at most one optional TTL string; the count of extra arguments is reported so hook authors get a precise diagnostic at expression-evaluation time instead of a silent default.

Source

Thrown at pkg/appsec/waf_helpers.go:55

			logger.Warnf("unknown fingerprint log verbosity %q; falling back to info", verbosity[0])
		}

		return challenge.FingerprintLogInfo
	}
}

// parseChallengeCookieTTLArg interprets the optional TTL argument to the
// GrantChallengeCookie expr helper. Zero variadic args means "use the
// runtime default" and yields a nil override. A single non-empty string is
// parsed with time.ParseDuration (e.g. "1h", "30m"). More than one TTL
// argument or an unparseable value is reported as an error so hook authors
// get a precise diagnostic at evaluation time rather than a silent fallback.
func parseChallengeCookieTTLArg(ttl []string) (*time.Duration, error) {
	if len(ttl) == 0 {
		return nil, nil
	}
	if len(ttl) > 1 {
		return nil, fmt.Errorf("GrantChallengeCookie accepts at most one TTL argument, got %d", len(ttl))
	}
	if ttl[0] == "" {
		return nil, nil
	}
	d, err := time.ParseDuration(ttl[0])
	if err != nil {
		return nil, fmt.Errorf("invalid GrantChallengeCookie TTL %q: %w", ttl[0], err)
	}
	if d <= 0 {
		return nil, fmt.Errorf("GrantChallengeCookie TTL must be positive, got %s", d)
	}
	return &d, nil
}

func GetOnLoadEnv(w *AppsecRuntimeConfig) map[string]interface{} {
	return map[string]interface{}{
		"RemoveInBandRuleByID":         w.DisableInBandRuleByID,
		"RemoveInBandRuleByTag":        w.DisableInBandRuleByTag,

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the hook call: GrantChallengeCookie() or GrantChallengeCookie("30m") — a single TTL string at most

When it happens

Trigger: Thrown at pkg/appsec/waf_helpers.go:55 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/596c8d5696319648. Report an issue: GitHub.