crowdsecurity/crowdsec · error

GrantChallengeCookie TTL must be positive, got %s

Error message

GrantChallengeCookie TTL must be positive, got %s

What it means

The GrantChallengeCookie TTL argument parsed successfully but is zero or negative. A non-positive TTL would create a cookie that is expired on arrival, so it is rejected outright with the offending value shown.

Source

Thrown at pkg/appsec/waf_helpers.go:65

// parsed with time.ParseDuration (e.g. "1h", "30m"). More than one TTL
// argument or an unparseable value is reported as an error so hook authors
// get a precise diagnostic at evaluation time rather than a silent fallback.
func parseChallengeCookieTTLArg(ttl []string) (*time.Duration, error) {
	if len(ttl) == 0 {
		return nil, nil
	}
	if len(ttl) > 1 {
		return nil, fmt.Errorf("GrantChallengeCookie accepts at most one TTL argument, got %d", len(ttl))
	}
	if ttl[0] == "" {
		return nil, nil
	}
	d, err := time.ParseDuration(ttl[0])
	if err != nil {
		return nil, fmt.Errorf("invalid GrantChallengeCookie TTL %q: %w", ttl[0], err)
	}
	if d <= 0 {
		return nil, fmt.Errorf("GrantChallengeCookie TTL must be positive, got %s", d)
	}
	return &d, nil
}

func GetOnLoadEnv(w *AppsecRuntimeConfig) map[string]interface{} {
	return map[string]interface{}{
		"RemoveInBandRuleByID":         w.DisableInBandRuleByID,
		"RemoveInBandRuleByTag":        w.DisableInBandRuleByTag,
		"RemoveInBandRuleByName":       w.DisableInBandRuleByName,
		"RemoveOutBandRuleByID":        w.DisableOutBandRuleByID,
		"RemoveOutBandRuleByTag":       w.DisableOutBandRuleByTag,
		"RemoveOutBandRuleByName":      w.DisableOutBandRuleByName,
		"SetRemediationByTag":          w.SetActionByTag,
		"SetRemediationByID":           w.SetActionByID,
		"SetRemediationByName":         w.SetActionByName,
		"SetChallengeDifficulty":       w.SetChallengeDifficulty,
		"LoadAPISchemaWithName":        w.LoadAPISchemaWithName,
		"LoadAPISchemaWithOptions":     w.LoadAPISchemaWithOptions,

View on GitHub (pinned to 909b515798)

Solutions

1. Pass a positive duration such as "1h", or omit the argument to use the runtime default TTL

When it happens

Trigger: Thrown at pkg/appsec/waf_helpers.go:65 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/913f51bf6d12a81a. Report an issue: GitHub.