What causes "multiple cookies with name %s found" in crowdsecurity/crowdsec?

Clear duplicate cookies so only one cookie with the required name is sent.

multiple cookies with name %s found

Error message

multiple cookies with name %s found

What it means

While resolving an apiKey security scheme located in a cookie, CookiesNamed returned more than one cookie with the scheme's name. Duplicate cookies make the token ambiguous, so the request fails the security requirement instead of picking arbitrarily.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:276

				}
				authTokenValue = values[0]
			case "header":
				canonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)
				values := input.RequestValidationInput.Request.Header[canonicalHeaderName]
				if len(values) == 0 {
					return fmt.Errorf("header %s not found", input.SecurityScheme.Name)
				}
				if len(values) > 1 {
					return fmt.Errorf("multiple headers with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = values[0]
			case "cookie":
				cookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)
				if len(cookieValues) == 0 {
					return fmt.Errorf("cookie %s not found", input.SecurityScheme.Name)
				}
				if len(cookieValues) > 1 {
					return fmt.Errorf("multiple cookies with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = cookieValues[0].Value
			default:
				return fmt.Errorf("unsupported apiKey location %s", input.SecurityScheme.In)
			}
		case "oauth2", "openIdConnect":
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("%s security scheme not supported", input.SecurityScheme.Type)
		default:
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("unsupported security scheme type %s", input.SecurityScheme.Type)
		}
		if authTokenValue == "" {
			return errors.New("auth token is required but not provided")

View on GitHub (pinned to 909b515798)

Solutions

Clear duplicate cookies so only one cookie with the required name is sent.
Fix the server/app to set cookies with a consistent Path/Domain so they overwrite rather than coexist.
Delete stale cookies from the client or use a cookie jar that replaces same-name cookies.

Example fix

// before: setting same cookie on two paths
http.SetCookie(w, &http.Cookie{Name: "session", Value: v, Path: "/"})
http.SetCookie(w, &http.Cookie{Name: "session", Value: v, Path: "/app"})
// after
http.SetCookie(w, &http.Cookie{Name: "session", Value: v, Path: "/"})

Defensive patterns

Strategy: validation

Validate before calling

if len(req.CookiesNamed("session")) != 1 { return errors.New("exactly one session cookie expected") }

Try / catch

err := validator.ValidateRequest(input); if err != nil { if strings.Contains(err.Error(), "multiple cookies") { return ErrDuplicateCookie } return err }

Prevention

Set cookies with a single consistent Path/Domain so they overwrite
Clear old cookies when re-issuing credentials
Use a cookie jar that dedupes by name per domain

When it happens

Trigger: CookiesNamed(input.SecurityScheme.Name) returns more than one cookie at pkg/appsec/api_validation/api_validation.go:276.

Common situations: Cookies set on different paths/domains both matching the request (e.g. a stale cookie at / and a new one at /app); apps re-issuing cookies without clearing the old one.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5a5943e04f687d81. Report an issue: GitHub.