crowdsecurity/crowdsec · error

invalid HTTP status code

Error message

invalid HTTP status code

What it means

When a custom_status_code is configured for the HTTP source (the status returned to the client), it must map to a known HTTP status via http.StatusText. An unknown/empty status text means the number is not a recognized HTTP status code, so Validate() rejects it in pkg/acquisition/modules/http/config.go:152.

Source

Thrown at pkg/acquisition/modules/http/config.go:152

		if c.TLS.ServerKey == "" {
			return errors.New("server_key is required")
		}
	}

	if c.MaxBodySize != nil && *c.MaxBodySize <= 0 {
		return errors.New("max_body_size must be positive")
	}

	/*
		if hc.ChunkSize != nil && *hc.ChunkSize <= 0 {
			return errors.New("chunk_size must be positive")
		}
	*/

	if c.CustomStatusCode != nil {
		statusText := http.StatusText(*c.CustomStatusCode)
		if statusText == "" {
			return errors.New("invalid HTTP status code")
		}
	}

	return nil
}

func (s *Source) Configure(_ context.Context, yamlConfig []byte, logger *log.Entry, metricsLevel metrics.AcquisitionMetricsLevel) error {
	s.logger = logger
	s.metricsLevel = metricsLevel

	err := s.UnmarshalConfig(yamlConfig)
	if err != nil {
		return err
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Set custom_status_code to a valid HTTP status code between 100 and 599 that http.StatusText recognizes (e.g. 200, 404).
2. Remove the custom_status_code key entirely to use the default behavior.
3. Validate the number against the HTTP spec before writing the config (100–599, not a reserved/undefined value).

Example fix

// before (acquis.yaml)
source: http
custom_status_code: 999

// after
source: http
custom_status_code: 200

if cfg.CustomStatusCode != nil {
    if http.StatusText(*cfg.CustomStatusCode) == "" {
        return fmt.Errorf("invalid custom_status_code: %d", *cfg.CustomStatusCode)
    }
}

func validHTTPStatus(code int) bool { return http.StatusText(code) != "" }

When it happens

Trigger: Calling Validate() on an http source Configuration with CustomStatusCode set to a number that is not a valid HTTP status code (e.g. 0, 999, 1234).

Common situations: Hand-editing the YAML and typing an invalid number; setting 0 to mean 'default' instead of leaving the key unset; generated configs plugging in an uninitialized integer.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• path must start with /
• chunk_size must be positive
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4cb25a31cd4fdd11. Report an issue: GitHub.