{"record":{"id":"8b421637edf99285","repo":"crowdsecurity/crowdsec","slug":"query-parameter-s-not-found","errorCode":null,"errorMessage":"query parameter %s not found","messagePattern":"query parameter (.+?) not found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":254,"sourceCode":"\t\t\t\tvalues := input.RequestValidationInput.Request.Header[\"Authorization\"]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn errors.New(\"authorization header not found\")\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn errors.New(\"multiple Authorization headers found\")\n\t\t\t\t}\n\t\t\t\tif !strings.HasPrefix(values[0], \"Bearer \") {\n\t\t\t\t\treturn errors.New(\"authorization header does not start with 'Bearer '\")\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0][7:]\n\t\t\t}\n\t\tcase \"apiKey\":\n\t\t\tswitch input.SecurityScheme.In {\n\t\t\tcase \"query\":\n\t\t\t\t//Because we are checking for the presence of the API key, it probably does not matter if go drops parameters using ; as a separator\n\t\t\t\tvalues := input.RequestValidationInput.Request.URL.Query()[input.SecurityScheme.Name]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"query parameter %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple query parameters with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"header\":\n\t\t\t\tcanonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[canonicalHeaderName]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"header %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple headers with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"cookie\":\n\t\t\t\tcookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)\n\t\t\t\tif len(cookieValues) == 0 {","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L236-L272","documentation":"During security-scheme validation of an apiKey defined in the query string, the request's URL query is inspected for the scheme's parameter name. If no values are present, this error is returned because the required API key is missing from the request.","triggerScenarios":"A request validated against an OpenAPI securityScheme with In: \"query\" lacks the named query parameter — URL.Query()[name] returns zero values at pkg/appsec/api_validation/api_validation.go:254.","commonSituations":"Client omits the API key query parameter; parameter name in the spec differs from what the client sends; URL parsing dropped the parameter.","solutions":["Include the required query parameter (the API key) in the request URL.","Confirm the securityScheme Name in the OpenAPI spec matches the parameter name clients actually send.","Check for URL encoding issues that strip or mangle the query parameter."],"exampleFix":"// before\ndefaultQuery := \"/resource\"\n// after\ndefaultQuery := \"/resource?api_key=<key>\"","handlingStrategy":"validation","validationCode":"u, _ := url.Parse(target); if u.Query().Get(\"api_key\") == \"\" { return errors.New(\"api_key query parameter required\") }","typeGuard":null,"tryCatchPattern":"err := validator.ValidateRequest(input); if err != nil { if strings.Contains(err.Error(), \"query parameter\") && strings.Contains(err.Error(), \"not found\") { return ErrMissingAPIKey } return err }","preventionTips":["Always append the API key query parameter when the spec requires it","Keep spec parameter names in sync with client code","Test requests against the schema before deploying"],"tags":["appsec","openapi","api-key","query-parameter","auth"],"backgroundTag":"missing-api-key","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}