{"record":{"id":"5923af776d63308e","repo":"crowdsecurity/crowdsec","slug":"authorization-header-does-not-start-with-bearer","errorCode":null,"errorMessage":"authorization header does not start with 'Bearer '","messagePattern":"authorization header does not start with 'Bearer '","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":244,"sourceCode":"\t\t\t\t\treturn errors.New(\"authorization header not found\")\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn errors.New(\"multiple Authorization headers found\")\n\t\t\t\t}\n\t\t\t\tif !strings.HasPrefix(values[0], \"Basic \") {\n\t\t\t\t\treturn errors.New(\"authorization header does not start with 'Basic '\")\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0][6:]\n\t\t\tcase \"bearer\":\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[\"Authorization\"]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn errors.New(\"authorization header not found\")\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn errors.New(\"multiple Authorization headers found\")\n\t\t\t\t}\n\t\t\t\tif !strings.HasPrefix(values[0], \"Bearer \") {\n\t\t\t\t\treturn errors.New(\"authorization header does not start with 'Bearer '\")\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0][7:]\n\t\t\t}\n\t\tcase \"apiKey\":\n\t\t\tswitch input.SecurityScheme.In {\n\t\t\tcase \"query\":\n\t\t\t\t//Because we are checking for the presence of the API key, it probably does not matter if go drops parameters using ; as a separator\n\t\t\t\tvalues := input.RequestValidationInput.Request.URL.Query()[input.SecurityScheme.Name]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"query parameter %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple query parameters with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"header\":\n\t\t\t\tcanonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[canonicalHeaderName]","sourceCodeStart":226,"sourceCodeEnd":262,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L226-L262","documentation":"For a bearer-token security scheme, the single Authorization header must start with the exact prefix 'Bearer ' (capital B, one space). A present, singular header with any other value fails validation.","triggerScenarios":"Exactly one Authorization header whose value does not start with \"Bearer \" (e.g. 'Basic ...', 'bearer tok' lowercase, or a raw token with no scheme) while the scheme is bearer.","commonSituations":"Client switched from basic to bearer auth but still sends basic credentials; hand-rolled token code omitting the 'Bearer ' prefix; lowercase scheme from non-standard clients; token pasted without prefix.","solutions":["Set the header to 'Authorization: Bearer <token>' with capital B and a single space","If basic credentials are what you have, change the security scheme to scheme=basic","Normalize the scheme prefix in client code before sending (strings.ToUpper + explicit space)","Verify the token itself is valid — if the prefix is right but the token is garbage, you'll hit a downstream 401 instead"],"exampleFix":"// before\nreq.Header.Set(\"Authorization\", token)\n// after\nreq.Header.Set(\"Authorization\", \"Bearer \"+token)","handlingStrategy":"validation","validationCode":"v := req.Header.Get(\"Authorization\"); if !strings.HasPrefix(v, \"Bearer \") { return fmt.Errorf(\"expected 'Bearer ' prefix, got %q\", v) }","typeGuard":null,"tryCatchPattern":"if err := validator.Validate(req); err != nil { if strings.Contains(err.Error(), \"does not start with 'Bearer '\") { /* fix token prefix in client */ } }","preventionTips":["Always compose the header as \"Bearer \" + token in a shared helper","Strip whitespace and enforce scheme casing in client code","Keep basic/bearer scheme choice in the spec aligned with client credentials"],"tags":["http","auth","bearer","appsec"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}