What causes "while encoding request: %w" in crowdsecurity/crowdsec?

Read the wrapped error: if it is a json marshal error, look for unsupported types in custom request fields/headers being dumped

crowdsecurity/crowdsec · error

while encoding request

Error message

while encoding request: %w

What it means

ReqDumpFilter.ToJSON encodes the filtered request to the temp file with a json.Encoder. This error wraps json.Encode failing on the request structure (e.g. an unsupported or cyclic value), and the partially written temp file is deleted to avoid empty dumps.

Solutions

Read the wrapped error: if it is a json marshal error, look for unsupported types in custom request fields/headers being dumped
If it is a write error, check disk space and writability of the temp dir
Upgrade crowdsec — dumps of exotic requests have been hardened over time
If you only need the dump for debugging, retry the request reproduction with a simpler payload to isolate the offending field

Example fix

// note: the code logs err2 with the wrong variable (err, not err2)
// after patch
err2 := os.Remove(fd.Name())
if err2 != nil {
    log.Errorf("while removing temp file %s: %s", fd.Name(), err2)
}

Defensive patterns

Strategy: try-catch

Validate before calling

null

Try / catch

if err := dump.ToJSON(); err != nil {
    log.Errorf("request dump failed: %v", err)
    // non-fatal: skip dump and continue processing the request
}

Prevention

Treat dumps as best-effort debugging output
Watch disk space; encode failures can be write errors
Report marshal failures with the offending request shape upstream

When it happens

Trigger: Calling ToJSON when enc.Encode(req) returns an error — typically an unsupported type inside the request dump (marshal failure), or an I/O write error to the temp file handle.

Common situations: Unusual request payloads containing values that cannot be JSON-marshaled by the dump structures, or a temp file write failing mid-dump (disk full, file closed). A secondary logged error here shows the remove failure reason, not the encode one — a common misread.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/9e331922f1272a29. Report an issue: GitHub.

Appendix: source

Thrown at pkg/appsec/request.go:288

	fd, err := os.CreateTemp("", "crowdsec_req_dump_*.json")
	if err != nil {
		return fmt.Errorf("while creating temp file: %w", err)
	}
	defer fd.Close()
	enc := json.NewEncoder(fd)
	enc.SetIndent("", "  ")

	req := r.GetFilteredRequest()

	log.Tracef("dumping : %+v", req)

	if err := enc.Encode(req); err != nil {
		//Don't clobber the temp directory with empty files
		err2 := os.Remove(fd.Name())
		if err2 != nil {
			log.Errorf("while removing temp file %s: %s", fd.Name(), err)
		}
		return fmt.Errorf("while encoding request: %w", err)
	}
	log.Infof("request dumped to %s", fd.Name())
	return nil
}

// forwardedHeaders are the X-Crowdsec-Appsec-* headers the bouncer supplies to the WAF.
// They carry the original request's metadata and must be stripped before handing the request
// off to Coraza so they aren't mistaken for client-supplied headers.
var forwardedHeaders = []string{
	IPHeaderName,
	HostHeaderName,
	URIHeaderName,
	VerbHeaderName,
	UserAgentHeaderName,
	APIKeyHeaderName,
	HTTPVersionHeaderName,
	TransactionIDHeaderName,
}

View on GitHub (pinned to 909b515798)