crowdsecurity/crowdsec · error

max_body_size must be a positive integer

Error message

max_body_size must be a positive integer

What it means

SetMaxBodySize on AppsecRuntimeConfig enforces that the requested maximum HTTP body size is strictly positive. It is exposed to on_load hooks so rules can tune body inspection limits; a zero or negative value would disable or corrupt body-size accounting, so it is refused and the hook errors out.

Source

Thrown at pkg/appsec/appsec.go:1526

	return w.ChallengeRuntime.SetDifficulty(level)
}

// SetChallengeDifficultyPerRequest sets a per-request PoW difficulty override (used from pre_eval/post_eval).
func (*AppsecRuntimeConfig) SetChallengeDifficultyPerRequest(state *AppsecRequestState, level string) error {
	bits, err := challenge.DifficultyFromLevel(level)
	if err != nil {
		return err
	}

	state.ChallengeDifficulty = &bits

	return nil
}

// SetMaxBodySize sets the maximum allowed body size in bytes. Intended for use in on_load hooks.
func (w *AppsecRuntimeConfig) SetMaxBodySize(size int64) error {
	if size <= 0 {
		return errors.New("max_body_size must be a positive integer")
	}

	w.Logger.Debugf("setting max body size to %d bytes", size)
	w.BodySettings.MaxSize = size
	return nil
}

// SendChallenge issues a challenge HTML page for the current request. Cookie
// and submission handling live in ProcessOnChallengeRules; by the time this
// runs, state.Fingerprint has already been populated if a valid cookie was
// presented. If the client already proved a PoW at least as hard as the
// target difficulty for this request, SendChallenge is a no-op. When the
// target difficulty is raised (e.g. on_challenge calls SetChallengeDifficulty
// to punish a suspect fingerprint), the stored difficulty is lower than the
// target and a fresh challenge is issued.
// EvaluateMismatches runs all library-native + custom fingerprint mismatch
// checks, caches the result on state, and emits one structured Debug log
// line + one metric bump per fired signal on the first call of a given

View on GitHub (pinned to 909b515798)

Solutions

1. Use a positive integer byte count, e.g. max_body_size(10485760) for 10MB
2. If the goal is unlimited bodies, remove the max_body_size call and use the default body limit instead of passing 0
3. Check the on_load hook expression for variables that could resolve to zero or negative values

Example fix

// before (on_load hook)
max_body_size(0)

// after
max_body_size(10485760)

if size, err := strconv.ParseInt(cfg.MaxBodySize, 10, 64); err != nil || size <= 0 {
    return fmt.Errorf("max_body_size must be > 0, got %q", cfg.MaxBodySize)
}

When it happens

Trigger: Calling max_body_size(0) or a negative value from an on_load hook expression; calling the setter programmatically with size <= 0.

Common situations: A user writes `max_body_size(0)` thinking 0 means unlimited; a template or variable expansion yields a negative number; a typo passing a negative constant.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• ref cannot be empty
• on_challenge_submit hooks are only valid in-band, not under
• invalid challenge master_secret: %w
• appsec rule name is empty for %s
• path must start with /

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5a369eb9efbedcce. Report an issue: GitHub.