{"record":{"id":"84005ff6e5f56bd7","repo":"crowdsecurity/crowdsec","slug":"authorization-header-does-not-start-with-basic","errorCode":null,"errorMessage":"authorization header does not start with 'Basic '","messagePattern":"authorization header does not start with 'Basic '","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":232,"sourceCode":"\t}\n}\n\nfunc (*RequestValidator) authFunc(unsupportedPolicy Policy) openapi3filter.AuthenticationFunc {\n\treturn func(_ context.Context, input *openapi3filter.AuthenticationInput) error {\n\t\tauthTokenValue := \"\"\n\t\tswitch input.SecurityScheme.Type {\n\t\tcase \"http\":\n\t\t\tswitch input.SecurityScheme.Scheme {\n\t\t\tcase \"basic\":\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[\"Authorization\"]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn errors.New(\"authorization header not found\")\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn errors.New(\"multiple Authorization headers found\")\n\t\t\t\t}\n\t\t\t\tif !strings.HasPrefix(values[0], \"Basic \") {\n\t\t\t\t\treturn errors.New(\"authorization header does not start with 'Basic '\")\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0][6:]\n\t\t\tcase \"bearer\":\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[\"Authorization\"]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn errors.New(\"authorization header not found\")\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn errors.New(\"multiple Authorization headers found\")\n\t\t\t\t}\n\t\t\t\tif !strings.HasPrefix(values[0], \"Bearer \") {\n\t\t\t\t\treturn errors.New(\"authorization header does not start with 'Bearer '\")\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0][7:]\n\t\t\t}\n\t\tcase \"apiKey\":\n\t\t\tswitch input.SecurityScheme.In {\n\t\t\tcase \"query\":","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L214-L250","documentation":"For a basic-auth security scheme, the validator requires the Authorization header value to begin with the exact prefix 'Basic ' (capital B, one space). A header present and singular but with a different scheme or casing fails this check.","triggerScenarios":"A request with exactly one Authorization header whose value does not start with \"Basic \" while validated against type=http, scheme=basic — e.g. 'Bearer x', 'basic x' (lowercase), or 'Basicx'.","commonSituations":"Client configured for bearer auth while the API spec expects basic; lowercase 'basic' from hand-rolled auth code; missing space after the scheme; token accidentally pasted without the scheme prefix.","solutions":["Format the header as 'Authorization: Basic <base64(user:password)>', with capital B and a space","Fix client auth config: if you intended bearer tokens, update the OpenAPI security scheme to scheme=bearer instead","Generate credentials with standard tooling (curl -u, or base64.StdEncoding of 'user:pass') to avoid formatting mistakes","Check for proxies that rewrite or truncate the header value"],"exampleFix":"// before\nreq.Header.Set(\"Authorization\", \"basic \" + base64.StdEncoding.EncodeToString([]byte(\"u:p\")))\n// after\nreq.Header.Set(\"Authorization\", \"Basic \" + base64.StdEncoding.EncodeToString([]byte(\"u:p\")))","handlingStrategy":"validation","validationCode":"v := req.Header.Get(\"Authorization\"); if !strings.HasPrefix(v, \"Basic \") { return fmt.Errorf(\"expected 'Basic ' prefix, got %q\", v) }","typeGuard":null,"tryCatchPattern":"if err := validator.Validate(req); err != nil { if strings.Contains(err.Error(), \"does not start with 'Basic '\") { /* fix client auth scheme */ } }","preventionTips":["Build basic credentials with curl -u or base64(\"user:pass\") and the exact 'Basic ' prefix","Keep the OpenAPI scheme in sync with what clients actually send","Add a client-side unit test asserting the header format"],"tags":["http","auth","basic-auth","appsec"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}