crowdsecurity/crowdsec · error

unable to compile apply

Error message

unable to compile apply %s : %w

What it means

Hook.Build compiles each entry of the hook's `apply` list as expr programs that mutate the request/transaction state. If any apply expression fails expr.Compile, the hook build aborts with 'unable to compile apply'. Same nature as the filter compile error but for the apply (side-effect) expressions.

Solutions

1. Read the wrapped expr error to locate the failing apply expression and cause
2. Verify the variable you assign to exists in the AppSec expr environment (e.g. tx.*, req.*, vars.*)
3. Fix the apply expression in the appsec-config YAML
4. Compile-test each apply expression individually to find the offender in a multi-entry list

Example fix

// before
apply:
  - "tx.set('bad')"
// after
apply:
  - "tx.set('is_bad', true)"

When it happens

Trigger: Hook.Build iterating h.Apply where one expression fails expr.Compile: invalid syntax, assignment to an unknown variable slot, or calling an undefined function in the AppSec environment.

Common situations: Writing `tx.set('name', ...)` with wrong argument order or an unknown helper; typo in target variable; expressions copied from WAF rules that use a different syntax dialect.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• unable to compile filter
• compilation of failed
• compiling static expression
• error compiling the scope filter
• stash

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/ed32e81ccb245ba4. Report an issue: GitHub.

Appendix: source

Thrown at pkg/appsec/appsec.go:172

	}

	opts := exprhelpers.GetExprOptions(env)
	if patcher != nil {
		opts = append(opts, expr.Patch(patcher))
	}
	if h.Filter != "" {
		program, err := expr.Compile(h.Filter, opts...) // FIXME: opts
		if err != nil {
			return fmt.Errorf("unable to compile filter %s : %w", h.Filter, err)
		}

		h.FilterExpr = program
	}

	for _, apply := range h.Apply {
		program, err := expr.Compile(apply, opts...)
		if err != nil {
			return fmt.Errorf("unable to compile apply %s : %w", apply, err)
		}

		h.ApplyExpr = append(h.ApplyExpr, program)
	}

	return nil
}

type AppsecTempResponse struct {
	InBandInterrupt         bool
	OutOfBandInterrupt      bool
	Action                  string                // allow, deny, captcha, challenge, log
	UserHTTPResponseCode    int                   // The response code to send to the user
	UserHTTPBodyContent     string                // The body content to send to the user, only for challenge response
	UserHTTPCookies         []cookie.AppsecCookie // Raw Set-Cookie headers to send to the user.
	UserHeaders             map[string][]string   // Headers to send to the user
	BouncerHTTPResponseCode int                   // The response code to send to the remediation component
	SendEvent               bool                  // do we send an internal event on rule match

View on GitHub (pinned to 909b515798)