{"record":{"id":"96d54c2e088c10de","repo":"crowdsecurity/crowdsec","slug":"s-security-scheme-not-supported","errorCode":null,"errorMessage":"%s security scheme not supported","messagePattern":"(.+?) security scheme not supported","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":286,"sourceCode":"\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"cookie\":\n\t\t\t\tcookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)\n\t\t\t\tif len(cookieValues) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"cookie %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(cookieValues) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple cookies with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = cookieValues[0].Value\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"unsupported apiKey location %s\", input.SecurityScheme.In)\n\t\t\t}\n\t\tcase \"oauth2\", \"openIdConnect\":\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"%s security scheme not supported\", input.SecurityScheme.Type)\n\t\tdefault:\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"unsupported security scheme type %s\", input.SecurityScheme.Type)\n\t\t}\n\t\tif authTokenValue == \"\" {\n\t\t\treturn errors.New(\"auth token is required but not provided\")\n\t\t}\n\n\t\treturn nil\n\t}\n}\n\nfunc (rv *RequestValidator) LoadSchema(ref string, schema string, opts *SchemaOptions) error {\n\tif ref == \"\" {\n\t\treturn errors.New(\"ref cannot be empty\")\n\t}","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L268-L304","documentation":"The validator cannot enforce oauth2 or openIdConnect security schemes (it only checks presence of http/apiKey credentials). When a request requires such a scheme and the OnUnsupportedSecurityScheme policy is PolicyDrop (the default 'drop'), authFunc fails the request with this error, telling the operator the scheme type is not supported by the WAF.","triggerScenarios":"A client requests a route whose OpenAPI security requirement references a securityScheme of type oauth2 or openIdConnect, and on_unsupported_security_scheme is set to \"drop\" (or left at its default).","commonSituations":"Importing an existing API spec that uses OAuth2/OIDC flows; upgrading a schema to add oauth2 security after initial deployment; forgetting to set the ignore policy while the app itself handles OAuth at the application layer.","solutions":["Set the OnUnsupportedSecurityScheme schema option to PolicyIgnore (\"ignore\") so the WAF leaves OAuth enforcement to your application.","Declare a scheme the validator can check (http bearer) in the spec if clients use Authorization: Bearer tokens.","Verify the warning logged at schema load time (\"security scheme ... not supported\") and adjust deployment accordingly.","Remove the oauth2/openIdConnect security requirement from routes if it does not reflect real client behavior."],"exampleFix":"// before\nopts := &api_validation.SchemaOptions{}\nrv.LoadSchema(ref, schema, opts)\n\n// after\nopts := &api_validation.SchemaOptions{}\nopts.OnUnsupportedSecurityScheme = api_validation.PolicyIgnore\nrv.LoadSchema(ref, schema, opts)","handlingStrategy":"validation","validationCode":"// refuse oauth2/openIdConnect schemes unless policy is ignore\nif opts.OnUnsupportedSecurityScheme != api_validation.PolicyIgnore {\n    for name, sr := range doc.Components.SecuritySchemes {\n        if sr.Value != nil && (sr.Value.Type == \"oauth2\" || sr.Value.Type == \"openIdConnect\") {\n            return fmt.Errorf(\"scheme %q type %s requires PolicyIgnore\", name, sr.Value.Type)\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := rv.LoadSchema(ref, schema, opts); err != nil {\n    if strings.Contains(err.Error(), \"security scheme not supported\") {\n        opts.OnUnsupportedSecurityScheme = api_validation.PolicyIgnore\n        return rv.LoadSchema(ref, schema, opts)\n    }\n    return err\n}","preventionTips":["Set OnUnsupportedSecurityScheme to PolicyIgnore whenever the app handles OAuth itself","Check the schema-load warning log for unsupported scheme types","Keep OAuth enforcement at the application/ingress layer, out of the WAF spec"],"tags":["openapi","oauth2","appsec","security-scheme"],"backgroundTag":"unsupported-operation","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}