crowdsecurity/crowdsec · error · Error

pow: unusable salt

Error message

pow: unusable salt

What it means

Generic guard in the proof-of-work Web Worker: saltBytes() could not derive a usable salt from the challenge payload (m.p). This is a sentinel-style check, deliberately redundant with challenge.js's pre-flight validation, covering callers that drive the worker directly. It fires when the server-supplied challenge string is empty or in a form the salt hasher cannot consume, so no PoW solution can be computed.

Source

Thrown at pkg/appsec/challenge/pow-worker.js:169

self.onmessage = function (e) {
  var m = e.data || {};
  var difficulty = m.d | 0;

  // d <= 0 is "disabled". d > 64 is the server's Impossible hard-block, which
  // is rejected before the nonce is ever looked at — searching for it would
  // just pin every core forever.
  if (difficulty <= 0 || difficulty > 64) {
    self.postMessage("0");
    return;
  }

  var salt = saltBytes(String(m.p == null ? "" : m.p));
  if (salt === null) {
    // Deliberately redundant with challenge.js's pre-flight check — this one
    // covers callers that drive the worker directly, such as the differential
    // test. There is no slow path to fall back to: a salt this shape means the
    // server broke its own contract, and any nonce found would be rejected.
    throw new Error("pow: unusable salt");
  }

  self.postMessage(solve(salt, difficulty, m.start | 0, (m.stride | 0) || 1));
};

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the appsec remediation component sends a well-formed challenge payload with a non-empty salt ('p' field) to the worker
2. Check that the challenge string is not truncated or re-encoded between the server response and the worker postMessage
3. If driving the worker directly in tests, pass the same payload shape the appsec component produces

When it happens

Trigger: Thrown at pkg/appsec/challenge/pow-worker.js:169 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e4195113faf2592e. Report an issue: GitHub.