Anubis triggering more frequently than COOKIE_EXPIRATION_TIME

[rfinnie]

Hi, I'm running Anubis as so:

/usr/bin/docker run --name "%N" --rm \
    --mount type=volume,src=anubis,dst=/data \
    --mount type=bind,readonly,src=/etc/docker-containers/anubis,dst=/data/conf \
    -p 127.0.0.1:8923:8923/tcp \
    --env 'ED25519_PRIVATE_KEY_HEX=REDACTED' \
    --env 'TARGET=http://172.17.0.1:3923' \
    --env 'POLICY_FNAME=/data/conf/botPolicies.yaml' \
    --env 'COOKIE_EXPIRATION_TIME=120h' \
    ghcr.io/techarohq/anubis:latest

Works as expected, except it seems to trigger when I return to a site after a day or so, even though the techaro.lol-anubis-auth-XXXXXXXX cookie seems to be set correctly to be 5 days. For the sites in question, my browser does not use a cookie auto-deleter. Console log is normal for a challenge:

{
  "time": "2026-08-26T05:38:24.781425776Z",
  "level": "INFO",
  "source": {
    "function": "github.com/TecharoHQ/anubis/lib.(*Server).issueChallenge",
    "file": "github.com/TecharoHQ/anubis/lib/anubis.go",
    "line": 191
  },
  "msg": "new challenge issued",
  "subsystem": "anubis",
  "host": "example.com",
  "method": "GET",
  "path": "/",
  "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0",
  "accept_language": "en-US,en;q=0.9",
  "priority": "u=0, i",
  "x-forwarded-for": "",
  "x-real-ip": "2600:XXX",
  "challenge": "XXX",
  "weight": 10
}

Any idea how to further debug this? Thanks!

[vladpereverzyev]

One thing I'd check first is whether the cookie is actually being sent back to Anubis when you return to the site.

The Expires/Max-Age value only tells us that the browser intends to retain the cookie; it doesn't guarantee that it will be included in a particular request. Things like the cookie's Domain, Path, Secure, and SameSite attributes can affect this.

I'd suggest checking the request that triggered issueChallenge in Firefox DevTools → Network and looking at the Cookie request header. Specifically, verify whether the techaro.lol-anubis-auth-* cookie is present.

If the cookie is not being sent, the browser's cookie rules/configuration are probably the place to investigate.

If the cookie is being sent but Anubis still issues a new challenge, then I'd look at the Anubis logs around cookie validation. That would help distinguish between "cookie wasn't received" and "cookie was received but rejected/expired."

Also, since you're using latest, I'd try reproducing it with a pinned Anubis version as well, just to rule out a regression.

The fact that the cookie still appears in the browser with a 5-day expiration doesn't necessarily mean Anubis will accept it for the full 5 days.