{"record":{"id":"6654a20ca17d8292","repo":"crowdsecurity/crowdsec","slug":"missing-basic-auth","errorCode":null,"errorMessage":"missing basic auth","messagePattern":"missing basic auth","errorType":"http","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/http/run.go","lineNumber":31,"sourceCode":"\t\"os\"\n\t\"time\"\n\n\t\"github.com/prometheus/client_golang/prometheus\"\n\tlog \"github.com/sirupsen/logrus\"\n\t\"gopkg.in/tomb.v2\"\n\n\t\"github.com/crowdsecurity/go-cs-lib/trace\"\n\n\t\"github.com/crowdsecurity/crowdsec/pkg/csnet\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/metrics\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/pipeline\"\n)\n\nfunc authorizeRequest(r *http.Request, hc *Configuration) error {\n\tif hc.AuthType == \"basic_auth\" {\n\t\tusername, password, ok := r.BasicAuth()\n\t\tif !ok {\n\t\t\treturn errors.New(\"missing basic auth\")\n\t\t}\n\n\t\tif username != hc.BasicAuth.Username || password != hc.BasicAuth.Password {\n\t\t\treturn errors.New(\"invalid basic auth\")\n\t\t}\n\t}\n\n\tif hc.AuthType == \"headers\" {\n\t\tfor key, value := range hc.Headers {\n\t\t\tif r.Header.Get(key) != value {\n\t\t\t\treturn errors.New(\"invalid headers\")\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/run.go#L13-L49","documentation":"The HTTP source configured with auth_type: basic_auth acts as a server that authenticates incoming requests. authorizeRequest() (pkg/acquisition/modules/http/run.go:31) parses the request's Authorization header via r.BasicAuth(); if the header is absent or malformed (not 'Basic base64(user:pass)'), the request is rejected with 'missing basic auth' before any credentials are compared.","triggerScenarios":"Sending an HTTP request to a crowdsec http source configured with auth_type: basic_auth without an Authorization header, or with a malformed one (wrong scheme, non-base64 payload).","commonSituations":"Client (curl, log shipper, webhook sender) was never given credentials; client uses bearer/token auth instead of basic; a proxy strips the Authorization header.","solutions":["Add the Basic Authorization header to the client request, e.g. curl -u user:password http://host:port/.","Check the client actually uses basic auth, matching the configured auth_type: basic_auth (not digest/bearer/headers).","If a proxy sits in between, ensure it forwards the Authorization header.","If no auth is desired, change the source config auth_type away from basic_auth."],"exampleFix":"// before\ncurl http://localhost:8080/logs\n\n// after\ncurl -u myuser:mypass http://localhost:8080/logs","handlingStrategy":"validation","validationCode":"u, p, ok := r.BasicAuth()\nif !ok {\n    // request lacks a well-formed Basic Authorization header; add it before sending\n}\n_ = u\n_ = p","typeGuard":"func hasBasicAuth(r *http.Request) bool { _, _, ok := r.BasicAuth(); return ok }","tryCatchPattern":"if err := authorizeRequest(req, cfg); err != nil {\n    if err.Error() == \"missing basic auth\" {\n        // fix client: attach -u user:pass / Authorization: Basic base64(user:pass)\n    }\n}","preventionTips":["Configure clients with credentials up front (curl -u, or an Authorization header in your shipper).","Ensure auth_type in the source config matches what the client actually implements.","Verify proxies preserve the Authorization header."],"tags":["http","authentication","basic-auth"],"backgroundTag":"authentication-required","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}