crowdsecurity/crowdsec · error

invalid 'on_success' for %s hook : %s

Error message

invalid 'on_success' for %s hook : %s

What it means

buildHookList validates each hook's on_success field before compiling it; the only permitted values are the empty string, 'continue', and 'break'. Any other string aborts the build of that hook stage with this message naming the stage and the bad value. It is an enum-validation error on hook control-flow configuration.

Source

Thrown at pkg/appsec/appsec.go:832

			wc.OutOfBandOptions.DisableBodyInspection = true
		}

		if wc.OutOfBand.Options.RequestBodyInMemoryLimit != nil {
			wc.OutOfBandOptions.RequestBodyInMemoryLimit = wc.OutOfBand.Options.RequestBodyInMemoryLimit
		}

		wc.VariablesTracking = append(wc.VariablesTracking, wc.OutOfBand.VariablesTracking...)
		wc.OutOfBand.VariablesTracking = nil
	}
}

// buildHookList validates and compiles a list of hooks of the given stage.
func buildHookList(ctx context.Context, hooks []Hook, stage hookStage, patcher *appsecExprPatcher) ([]Hook, error) {
	var compiled []Hook

	for _, hook := range hooks {
		if hook.OnSuccess != "" && hook.OnSuccess != "continue" && hook.OnSuccess != "break" {
			return nil, fmt.Errorf("invalid 'on_success' for %s hook : %s", stage, hook.OnSuccess)
		}

		if err := hook.Build(ctx, stage, patcher); err != nil {
			return nil, fmt.Errorf("unable to build %s hook : %w", stage, err)
		}

		compiled = append(compiled, hook)
	}

	return compiled, nil
}

// buildPhaseHooks compiles pre_eval / post_eval / on_match hook lists into a
// PhaseHooks. phaseName is only used to wrap errors ("" for the shared section).
func buildPhaseHooks(ctx context.Context, phaseName string, pre, post, onMatch []Hook, patcher *appsecExprPatcher) (PhaseHooks, error) {
	var (
		out PhaseHooks
		err error

View on GitHub (pinned to 909b515798)

Solutions

1. Change on_success to exactly 'continue' or 'break' (lowercase), or remove the key to use the default
2. Check the stage name in the error to find which phase section of the YAML has the bad value
3. Grep your appsec-configs/rules for on_success to catch all occurrences at once

Example fix

// before
- filter: "..."
  on_success: stop
// after
- filter: "..."
  on_success: break

When it happens

Trigger: An appsec-config or rules YAML sets on_success: "Continue", "stop", "return", or any value other than continue/break on a hook (pre_eval, post_eval, or on_match), triggering Build/buildHookList during AppsecConfig build.

Common situations: Typo or wrong casing in on_success (values are lowercase and case-sensitive); copying on_success semantics from other WAF engines that use different keywords; misunderstanding that on_success is optional (omit it entirely instead of inventing values).

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• invalid policy %q (expected %q or %q)
• invalid body_size_exceeded_action %q (must be %s, %s, or %s)
• ref cannot be empty
• on_challenge hooks are only valid in-band, not under outofba
• on_challenge_submit hooks are only valid in-band, not under

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/174267901bfaf713. Report an issue: GitHub.