crowdsecurity/crowdsec · error

invalid body_size_exceeded_action %q (must be %s, %s, or %s)

Error message

invalid body_size_exceeded_action %q (must be %s, %s, or %s)

What it means

The appsec-config's body_size_exceeded_action accepts only three enum values: drop, partial, allow. The SetBodySizeExceededAction-style setter rejects any other string with this error. It is a config validation error caught at appsec runtime build time.

Source

Thrown at pkg/appsec/appsec.go:1803

	}

	state.Fingerprint.LogAccepted(w.Logger, log.InfoLevel, request.ClientIP, request.RemoteAddrNormalized, "granted allowlist challenge cookie inline (submit phase)")

	return nil
}

// SetBodySizeExceededAction sets what happens when the body exceeds the maximum size.
// Valid values: "drop" (block request), "partial" (inspect up to max size), "allow" (skip body inspection).
// Intended for use in on_load hooks.
func (w *AppsecRuntimeConfig) SetBodySizeExceededAction(action string) error {
	switch action {
	case BodySizeActionDrop, BodySizeActionPartial, BodySizeActionAllow:
		w.Logger.Debugf("setting body size exceeded action to %q", action)
		w.BodySettings.Action = action

		return nil
	default:
		return fmt.Errorf("invalid body_size_exceeded_action %q (must be %s, %s, or %s)", action, BodySizeActionDrop, BodySizeActionPartial, BodySizeActionAllow)
	}
}

// DisableBodyInspection prevents Coraza from processing the request body for the current request.
// Intended for use in pre_eval hooks.
func (w *AppsecRuntimeConfig) DisableBodyInspection(state *AppsecRequestState) error {
	state.DisableBodyInspection = true
	w.Logger.Debugf("body inspection disabled for this request")

	return nil
}

type BodyResponse struct {
	Action          string              `json:"action"`
	HTTPStatus      int                 `json:"http_status"`
	UserBodyContent string              `json:"user_body_content,omitempty"`
	UserCookies     []string            `json:"user_cookies,omitempty"`
	UserHeaders     map[string][]string `json:"user_headers,omitempty"`

View on GitHub (pinned to 909b515798)

Solutions

1. Set the value to exactly one of: drop, partial, allow (lowercase)
2. Remove the key entirely to use the default action
3. Check the version's documentation — if only drop/partial existed in your version, upgrade before using allow
4. Quote the YAML value to avoid parser mangling

Example fix

// before (appsec-config.yaml)
body_size_exceeded_action: block
// after
body_size_exceeded_action: drop

valid := map[string]bool{"drop": true, "partial": true, "allow": true}
if v := cfg.BodySizeExceededAction; v != "" && !valid[strings.ToLower(v)] {
    return fmt.Errorf("body_size_exceeded_action must be drop, partial or allow, got %q", v)
}

if err := buildAppsecRuntime(cfg); err != nil {
    if strings.Contains(err.Error(), "body_size_exceeded_action") {
        log.Fatalf("fix appsec-config enum value: %v", err)
    }
    return err
}

When it happens

Trigger: Setting `body_size_exceeded_action:` in an appsec-config to a value like `block`, `reject`, or `DROP` (case-sensitive) instead of exactly drop/partial/allow.

Common situations: User guesses the action name by analogy with other WAF configs; uppercase value; documentation from an older version listing different actions; YAML unquoted value altered by parsing.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• invalid policy %q (expected %q or %q)
• invalid 'on_success' for %s hook : %s
• ref cannot be empty
• on_challenge hooks are only valid in-band, not under outofba
• on_challenge_submit hooks are only valid in-band, not under

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6ea82fb3e28c5efc. Report an issue: GitHub.