crowdsecurity/crowdsec · error

invalid GrantChallengeCookie TTL %q: %w

Error message

invalid GrantChallengeCookie TTL %q: %w

What it means

The single TTL argument passed to GrantChallengeCookie could not be parsed by time.ParseDuration — e.g. "1 hour", "1d", or a typo. The invalid literal is echoed along with the parse error; the helper errors instead of silently falling back to the runtime default.

Source

Thrown at pkg/appsec/waf_helpers.go:62

// parseChallengeCookieTTLArg interprets the optional TTL argument to the
// GrantChallengeCookie expr helper. Zero variadic args means "use the
// runtime default" and yields a nil override. A single non-empty string is
// parsed with time.ParseDuration (e.g. "1h", "30m"). More than one TTL
// argument or an unparseable value is reported as an error so hook authors
// get a precise diagnostic at evaluation time rather than a silent fallback.
func parseChallengeCookieTTLArg(ttl []string) (*time.Duration, error) {
	if len(ttl) == 0 {
		return nil, nil
	}
	if len(ttl) > 1 {
		return nil, fmt.Errorf("GrantChallengeCookie accepts at most one TTL argument, got %d", len(ttl))
	}
	if ttl[0] == "" {
		return nil, nil
	}
	d, err := time.ParseDuration(ttl[0])
	if err != nil {
		return nil, fmt.Errorf("invalid GrantChallengeCookie TTL %q: %w", ttl[0], err)
	}
	if d <= 0 {
		return nil, fmt.Errorf("GrantChallengeCookie TTL must be positive, got %s", d)
	}
	return &d, nil
}

func GetOnLoadEnv(w *AppsecRuntimeConfig) map[string]interface{} {
	return map[string]interface{}{
		"RemoveInBandRuleByID":         w.DisableInBandRuleByID,
		"RemoveInBandRuleByTag":        w.DisableInBandRuleByTag,
		"RemoveInBandRuleByName":       w.DisableInBandRuleByName,
		"RemoveOutBandRuleByID":        w.DisableOutBandRuleByID,
		"RemoveOutBandRuleByTag":       w.DisableOutBandRuleByTag,
		"RemoveOutBandRuleByName":      w.DisableOutBandRuleByName,
		"SetRemediationByTag":          w.SetActionByTag,
		"SetRemediationByID":           w.SetActionByID,
		"SetRemediationByName":         w.SetActionByName,

View on GitHub (pinned to 909b515798)

Solutions

1. Use Go duration syntax: "1h", "30m", "90s" — "d" (days) is not supported, express it in hours

When it happens

Trigger: Thrown at pkg/appsec/waf_helpers.go:62 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/eedaa9cdf068c4f0. Report an issue: GitHub.