crowdsecurity/crowdsec · error

multiple cookies with name

Error message

multiple cookies with name %s found

What it means

While resolving an apiKey security scheme located in a cookie, CookiesNamed returned more than one cookie with the scheme's name. Duplicate cookies make the token ambiguous, so the request fails the security requirement instead of picking arbitrarily.

Solutions

1. Clear duplicate cookies so only one cookie with the required name is sent.
2. Fix the server/app to set cookies with a consistent Path/Domain so they overwrite rather than coexist.
3. Delete stale cookies from the client or use a cookie jar that replaces same-name cookies.

Example fix

// before: setting same cookie on two paths
http.SetCookie(w, &http.Cookie{Name: "session", Value: v, Path: "/"})
http.SetCookie(w, &http.Cookie{Name: "session", Value: v, Path: "/app"})
// after
http.SetCookie(w, &http.Cookie{Name: "session", Value: v, Path: "/"})

if len(req.CookiesNamed("session")) != 1 { return errors.New("exactly one session cookie expected") }

err := validator.ValidateRequest(input); if err != nil { if strings.Contains(err.Error(), "multiple cookies") { return ErrDuplicateCookie } return err }

When it happens

Trigger: CookiesNamed(input.SecurityScheme.Name) returns more than one cookie at pkg/appsec/api_validation/api_validation.go:276.

Common situations: Cookies set on different paths/domains both matching the request (e.g. a stale cookie at / and a new one at /app); apps re-issuing cookies without clearing the old one.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors

• cookie not found
• multiple headers with name
• multiple query parameters with name
• auth token is required but not provided
• header not found

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5a5943e04f687d81. Report an issue: GitHub.

Appendix: source

Thrown at pkg/appsec/api_validation/api_validation.go:276

				}
				authTokenValue = values[0]
			case "header":
				canonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)
				values := input.RequestValidationInput.Request.Header[canonicalHeaderName]
				if len(values) == 0 {
					return fmt.Errorf("header %s not found", input.SecurityScheme.Name)
				}
				if len(values) > 1 {
					return fmt.Errorf("multiple headers with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = values[0]
			case "cookie":
				cookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)
				if len(cookieValues) == 0 {
					return fmt.Errorf("cookie %s not found", input.SecurityScheme.Name)
				}
				if len(cookieValues) > 1 {
					return fmt.Errorf("multiple cookies with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = cookieValues[0].Value
			default:
				return fmt.Errorf("unsupported apiKey location %s", input.SecurityScheme.In)
			}
		case "oauth2", "openIdConnect":
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("%s security scheme not supported", input.SecurityScheme.Type)
		default:
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("unsupported security scheme type %s", input.SecurityScheme.Type)
		}
		if authTokenValue == "" {
			return errors.New("auth token is required but not provided")

View on GitHub (pinned to 909b515798)