{"record":{"id":"9074b2517de6b1ac","repo":"crowdsecurity/crowdsec","slug":"authorization-header-not-found","errorCode":null,"errorMessage":"authorization header not found","messagePattern":"authorization header not found","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":226,"sourceCode":"\t\t}\n\t\tswitch schemeRef.Value.Type {\n\t\tcase \"oauth2\", \"openIdConnect\":\n\t\t\trv.logger.Warnf(\"schema %q: security scheme %q (type %s) is not supported and %s for any request that requires it\",\n\t\t\t\tref, name, schemeRef.Value.Type, action)\n\t\t}\n\t}\n}\n\nfunc (*RequestValidator) authFunc(unsupportedPolicy Policy) openapi3filter.AuthenticationFunc {\n\treturn func(_ context.Context, input *openapi3filter.AuthenticationInput) error {\n\t\tauthTokenValue := \"\"\n\t\tswitch input.SecurityScheme.Type {\n\t\tcase \"http\":\n\t\t\tswitch input.SecurityScheme.Scheme {\n\t\t\tcase \"basic\":\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[\"Authorization\"]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn errors.New(\"authorization header not found\")\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn errors.New(\"multiple Authorization headers found\")\n\t\t\t\t}\n\t\t\t\tif !strings.HasPrefix(values[0], \"Basic \") {\n\t\t\t\t\treturn errors.New(\"authorization header does not start with 'Basic '\")\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0][6:]\n\t\t\tcase \"bearer\":\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[\"Authorization\"]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn errors.New(\"authorization header not found\")\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn errors.New(\"multiple Authorization headers found\")\n\t\t\t\t}\n\t\t\t\tif !strings.HasPrefix(values[0], \"Bearer \") {\n\t\t\t\t\treturn errors.New(\"authorization header does not start with 'Bearer '\")","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L208-L244","documentation":"The AppSec request validator validates HTTP requests against an OpenAPI security scheme of type 'http' with scheme 'basic'. When basic-auth validation is configured, the request MUST carry exactly one Authorization header starting with 'Basic '. This error is thrown when the Authorization header is entirely absent from the request.","triggerScenarios":"A request is validated against an API definition whose securityScheme has type=http and scheme=basic, and the incoming request contains no Authorization header at all (input.RequestValidationInput.Request.Header[\"Authorization\"] has length 0).","commonSituations":"Clients hitting a protected endpoint without credentials; curl/browser requests omitting -u/--header; a proxy or load balancer stripping the Authorization header; anonymous health checks or monitoring probes hitting endpoints that the OpenAPI spec marks as requiring basic auth.","solutions":["Send the Authorization header with the request, e.g. curl -u user:pass (curl adds 'Authorization: Basic base64(user:pass)')","If the endpoint should be anonymous, update the OpenAPI security scheme so basic auth is not required for this operation","Check intermediaries (reverse proxy, ingress, API gateway) for rules that strip or rename the Authorization header","If your AppSec config should not enforce this scheme, correct the security scheme loaded into the RequestValidator"],"exampleFix":"// before\ncurl https://api.example.com/protected\n// after\ncurl -u myuser:mypass https://api.example.com/protected","handlingStrategy":"validation","validationCode":"if len(req.Header.Values(\"Authorization\")) == 0 { return errors.New(\"request would be rejected: missing Authorization header for basic-auth scheme\") }","typeGuard":null,"tryCatchPattern":"if err := validator.Validate(req); err != nil { if strings.Contains(err.Error(), \"authorization header not found\") { /* treat as 401, prompt for credentials */ } }","preventionTips":["Always send credentials with requests to endpoints whose OpenAPI spec declares basic security","Check proxy/ingress configs for header-stripping rules","Run integration tests against the AppSec validator with and without auth headers"],"tags":["http","auth","appsec","openapi"],"backgroundTag":"missing-credentials","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}