{"record":{"id":"4f184779f4888717","repo":"crowdsecurity/crowdsec","slug":"auth-token-is-required-but-not-provided","errorCode":null,"errorMessage":"auth token is required but not provided","messagePattern":"auth token is required but not provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":294,"sourceCode":"\t\t\t\t\treturn fmt.Errorf(\"multiple cookies with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = cookieValues[0].Value\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"unsupported apiKey location %s\", input.SecurityScheme.In)\n\t\t\t}\n\t\tcase \"oauth2\", \"openIdConnect\":\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"%s security scheme not supported\", input.SecurityScheme.Type)\n\t\tdefault:\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"unsupported security scheme type %s\", input.SecurityScheme.Type)\n\t\t}\n\t\tif authTokenValue == \"\" {\n\t\t\treturn errors.New(\"auth token is required but not provided\")\n\t\t}\n\n\t\treturn nil\n\t}\n}\n\nfunc (rv *RequestValidator) LoadSchema(ref string, schema string, opts *SchemaOptions) error {\n\tif ref == \"\" {\n\t\treturn errors.New(\"ref cannot be empty\")\n\t}\n\trv.logger.Debugf(\"loading schema for ref %s\", ref)\n\n\tif _, exists := rv.loaders[ref]; exists {\n\t\treturn fmt.Errorf(\"attempting to load a new schema for existing ref %s\", ref)\n\t}\n\n\toptions := opts.withDefaults()\n\tif err := options.OnRouteNotFound.validate(); err != nil {","sourceCodeStart":276,"sourceCodeEnd":312,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L276-L312","documentation":"After all securityScheme type/in handlers run, the validator checks that an auth token was actually extracted. If the scheme is one the validator recognizes structurally but no code path set authTokenValue (e.g. apiKey in a location that yielded nothing, or the token extraction was skipped), this final guard fires.","triggerScenarios":"Request validation completes the scheme switch without setting authTokenValue (it remains \"\") — for example a security scheme whose combination of type/in didn't populate the token, while the scheme is still enforced (not PolicyIgnore).","commonSituations":"OpenAPI securityScheme declared with an unusual In value (cookie/header typo) so the apiKey extraction reads the wrong location and finds nothing; spec references a scheme variant the validator doesn't extract tokens for; requests legitimately missing the apiKey but the operation still requires it.","solutions":["Check the securityScheme 'in' field (query/header/cookie) matches where the client actually sends the credential","Have the client send the credential in the location the scheme declares (e.g. ?api_key=... for in=query)","If the scheme type is genuinely unsupported, set the appropriate policy (unsupportedPolicy=PolicyIgnore) or use a supported scheme type","Fix typos in the OpenAPI component so the expected header/query name matches the client's"],"exampleFix":"// spec before\n\"in\": \"head\"\n// spec after\n\"in\": \"header\"","handlingStrategy":"validation","validationCode":"scheme, _ := spec.Components.SecuritySchemes[name]; if scheme.In != \"header\" && scheme.In != \"query\" && scheme.In != \"cookie\" { return fmt.Errorf(\"unsupported securityScheme in=%q\", scheme.In) }","typeGuard":null,"tryCatchPattern":"if err := validator.Validate(req); err != nil { if strings.Contains(err.Error(), \"auth token is required\") { /* 401: credential missing in declared location */ } }","preventionTips":["Verify the securityScheme 'in' value matches where the client sends the key","Test each protected route with and without the credential","Avoid exotic scheme type/in combinations not supported by the validator; use PolicyIgnore deliberately"],"tags":["auth","appsec","openapi","api-key"],"backgroundTag":"missing-credentials","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}