{"record":{"id":"614bf2338af9f7ea","repo":"crowdsecurity/crowdsec","slug":"multiple-query-parameters-with-name-s-found","errorCode":null,"errorMessage":"multiple query parameters with name %s found","messagePattern":"multiple query parameters with name (.+?) found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":257,"sourceCode":"\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn errors.New(\"multiple Authorization headers found\")\n\t\t\t\t}\n\t\t\t\tif !strings.HasPrefix(values[0], \"Bearer \") {\n\t\t\t\t\treturn errors.New(\"authorization header does not start with 'Bearer '\")\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0][7:]\n\t\t\t}\n\t\tcase \"apiKey\":\n\t\t\tswitch input.SecurityScheme.In {\n\t\t\tcase \"query\":\n\t\t\t\t//Because we are checking for the presence of the API key, it probably does not matter if go drops parameters using ; as a separator\n\t\t\t\tvalues := input.RequestValidationInput.Request.URL.Query()[input.SecurityScheme.Name]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"query parameter %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple query parameters with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"header\":\n\t\t\t\tcanonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[canonicalHeaderName]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"header %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple headers with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"cookie\":\n\t\t\t\tcookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)\n\t\t\t\tif len(cookieValues) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"cookie %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(cookieValues) > 1 {","sourceCodeStart":239,"sourceCodeEnd":275,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L239-L275","documentation":"For query-located apiKey security schemes, the validator expects exactly one value for the named query parameter. If the URL query contains the parameter more than once, the value is ambiguous and this error is returned.","triggerScenarios":"A validated request's URL contains the apiKey query parameter two or more times (len(values) > 1) at pkg/appsec/api_validation/api_validation.go:257.","commonSituations":"Client or proxy appends the key twice (e.g. a redirect that re-appends parameters); templating bug duplicating the query string; HPP probes from an attacker.","solutions":["Send the API key query parameter exactly once in the request URL.","Inspect any redirect/proxy logic that may append query parameters twice.","If testing HPP behavior, expect this rejection — send a single-valued parameter."],"exampleFix":"// before\nurl := \"/resource?api_key=a&api_key=b\"\n// after\nurl := \"/resource?api_key=a\"","handlingStrategy":"validation","validationCode":"if len(u.Query()[\"api_key\"]) != 1 { return errors.New(\"api_key must appear exactly once\") }","typeGuard":null,"tryCatchPattern":"err := validator.ValidateRequest(input); if err != nil { if strings.Contains(err.Error(), \"multiple query parameters\") { return ErrDuplicateParam } return err }","preventionTips":["Use url.Values and Encode() to build query strings exactly once","Check redirect logic for re-appended parameters","Never manually concatenate query strings"],"tags":["appsec","openapi","api-key","query-parameter","duplicate"],"backgroundTag":"invalid-query-parameter","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}