crowdsecurity/crowdsec · error

unable to compile apply %s : %w

Error message

unable to compile apply %s : %w

What it means

Hook.Build compiles each entry of the hook's `apply` list as expr programs that mutate the request/transaction state. If any apply expression fails expr.Compile, the hook build aborts with 'unable to compile apply'. Same nature as the filter compile error but for the apply (side-effect) expressions.

Source

Thrown at pkg/appsec/appsec.go:172

	}

	opts := exprhelpers.GetExprOptions(env)
	if patcher != nil {
		opts = append(opts, expr.Patch(patcher))
	}
	if h.Filter != "" {
		program, err := expr.Compile(h.Filter, opts...) // FIXME: opts
		if err != nil {
			return fmt.Errorf("unable to compile filter %s : %w", h.Filter, err)
		}

		h.FilterExpr = program
	}

	for _, apply := range h.Apply {
		program, err := expr.Compile(apply, opts...)
		if err != nil {
			return fmt.Errorf("unable to compile apply %s : %w", apply, err)
		}

		h.ApplyExpr = append(h.ApplyExpr, program)
	}

	return nil
}

type AppsecTempResponse struct {
	InBandInterrupt         bool
	OutOfBandInterrupt      bool
	Action                  string                // allow, deny, captcha, challenge, log
	UserHTTPResponseCode    int                   // The response code to send to the user
	UserHTTPBodyContent     string                // The body content to send to the user, only for challenge response
	UserHTTPCookies         []cookie.AppsecCookie // Raw Set-Cookie headers to send to the user.
	UserHeaders             map[string][]string   // Headers to send to the user
	BouncerHTTPResponseCode int                   // The response code to send to the remediation component
	SendEvent               bool                  // do we send an internal event on rule match

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped expr error to locate the failing apply expression and cause
2. Verify the variable you assign to exists in the AppSec expr environment (e.g. tx.*, req.*, vars.*)
3. Fix the apply expression in the appsec-config YAML
4. Compile-test each apply expression individually to find the offender in a multi-entry list

Example fix

// before
apply:
  - "tx.set('bad')"
// after
apply:
  - "tx.set('is_bad', true)"

When it happens

Trigger: Hook.Build iterating h.Apply where one expression fails expr.Compile: invalid syntax, assignment to an unknown variable slot, or calling an undefined function in the AppSec environment.

Common situations: Writing `tx.set('name', ...)` with wrong argument order or an unknown helper; typo in target variable; expressions copied from WAF rules that use a different syntax dialect.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• unable to compile filter %s : %w
• unable to run appsec %s filter %s : %w
• error compiling the scope filter: %w
• compilation of %q failed: %v
• stash %s: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ed32e81ccb245ba4. Report an issue: GitHub.