crowdsecurity/crowdsec · error

%s: %w

Error message

%s: %w

What it means

buildPhaseHooks wraps any error from building the pre_eval, post_eval, or on_match hook lists with the phase name (e.g. 'pre_eval: unable to build ... hook'). The wrap is skipped when phaseName is empty (shared section). It only adds context — the root cause is always in the wrapped error.

Source

Thrown at pkg/appsec/appsec.go:857

		compiled = append(compiled, hook)
	}

	return compiled, nil
}

// buildPhaseHooks compiles pre_eval / post_eval / on_match hook lists into a
// PhaseHooks. phaseName is only used to wrap errors ("" for the shared section).
func buildPhaseHooks(ctx context.Context, phaseName string, pre, post, onMatch []Hook, patcher *appsecExprPatcher) (PhaseHooks, error) {
	var (
		out PhaseHooks
		err error
	)

	wrap := func(e error) error {
		if phaseName == "" || e == nil {
			return e
		}
		return fmt.Errorf("%s: %w", phaseName, e)
	}

	if out.PreEval, err = buildHookList(ctx, pre, hookPreEval, patcher); err != nil {
		return PhaseHooks{}, wrap(err)
	}

	if out.PostEval, err = buildHookList(ctx, post, hookPostEval, patcher); err != nil {
		return PhaseHooks{}, wrap(err)
	}

	if out.OnMatch, err = buildHookList(ctx, onMatch, hookOnMatch, patcher); err != nil {
		return PhaseHooks{}, wrap(err)
	}

	return out, nil
}

func (wc *AppsecConfig) Load(configName string, hub *cwhub.Hub) error {

View on GitHub (pinned to 909b515798)

Solutions

1. Use the phase prefix to jump to the matching section (pre_eval:/post_eval:/on_match:) in the appsec config
2. Unwrap the error chain (errors.Unwrap or %v of the full chain) to reach the root cause
3. Fix the offending hook per the inner error's guidance

When it happens

Trigger: AppsecConfig.Build → buildPhaseHooks with a phaseName set, and buildHookList fails for that phase (bad on_success value or hook Build failure).

Common situations: Debugging a broken appsec-config: this prefix tells you which phase section of the YAML to inspect; combined with 676/677 it gives stage + hook + root cause.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• ref cannot be empty
• on_challenge hooks are only valid in-band, not under outofba
• on_challenge_submit hooks are only valid in-band, not under
• max_body_size must be a positive integer
• empty master secret

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/abb29add6658dc92. Report an issue: GitHub.