{"record":{"id":"99e8c2fb2793236c","repo":"crowdsecurity/crowdsec","slug":"unsupported-apikey-location-s","errorCode":null,"errorMessage":"unsupported apiKey location %s","messagePattern":"unsupported apiKey location (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":280,"sourceCode":"\t\t\t\tvalues := input.RequestValidationInput.Request.Header[canonicalHeaderName]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"header %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple headers with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"cookie\":\n\t\t\t\tcookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)\n\t\t\t\tif len(cookieValues) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"cookie %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(cookieValues) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple cookies with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = cookieValues[0].Value\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"unsupported apiKey location %s\", input.SecurityScheme.In)\n\t\t\t}\n\t\tcase \"oauth2\", \"openIdConnect\":\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"%s security scheme not supported\", input.SecurityScheme.Type)\n\t\tdefault:\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"unsupported security scheme type %s\", input.SecurityScheme.Type)\n\t\t}\n\t\tif authTokenValue == \"\" {\n\t\t\treturn errors.New(\"auth token is required but not provided\")\n\t\t}\n\n\t\treturn nil\n\t}","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L262-L298","documentation":"The AppSec request validator only enforces apiKey security schemes located in 'query', 'header', or 'cookie'. If the OpenAPI schema declares an apiKey scheme with any other 'in' value, the per-request authentication check in authFunc returns this error, meaning the validator cannot locate the API key and fails the request validation.","triggerScenarios":"A request hits a route secured by an apiKey security scheme whose SecurityScheme.In is not one of query/header/cookie — e.g. a hand-edited or generated OpenAPI spec using a non-standard location value — and the on_unsupported_security_scheme policy does not resolve to ignore.","commonSituations":"Custom or code-generated OpenAPI specs with an invalid 'in' enum value (typos like 'headers', 'cookies', 'body'); schemas written for a different gateway that supports apiKey in other locations; copy-pasted scheme definitions with casing mistakes.","solutions":["Fix the security scheme in the OpenAPI schema so apiKey 'in' is exactly one of: query, header, cookie.","Set the validator's OnUnsupportedSecurityScheme option to PolicyIgnore (\"ignore\") so unsupported schemes are skipped instead of failing requests.","Change the scheme type to http bearer/basic if clients actually authenticate via the Authorization header.","Re-load the schema with RequestValidator.LoadSchema after fixing, under a new or the same ref."],"exampleFix":"// before (openapi yaml)\nsecuritySchemes:\n  ApiKeyAuth:\n    type: apiKey\n    in: headers   # typo, not query/header/cookie\n    name: X-API-Key\n\n// after\nsecuritySchemes:\n  ApiKeyAuth:\n    type: apiKey\n    in: header\n    name: X-API-Key","handlingStrategy":"validation","validationCode":"// before LoadSchema: scan spec for apiKey locations\nfor _, sr := range doc.Components.SecuritySchemes {\n    if sr.Value != nil && sr.Value.Type == \"apiKey\" &&\n       sr.Value.In != \"query\" && sr.Value.In != \"header\" && sr.Value.In != \"cookie\" {\n        return fmt.Errorf(\"scheme %q: unsupported apiKey location %q\", sr.Value.Name, sr.Value.In)\n    }\n}","typeGuard":"func validApiKeyIn(in string) bool { return in == \"query\" || in == \"header\" || in == \"cookie\" }","tryCatchPattern":"if err := rv.LoadSchema(ref, schema, opts); err != nil {\n    if strings.Contains(err.Error(), \"unsupported apiKey location\") {\n        log.Errorf(\"fix the securitySchemes section: %v\", err)\n    }\n    return err\n}","preventionTips":["Only use query/header/cookie for apiKey 'in' in specs enforced by the WAF","Validate specs with an OpenAPI linter in CI before deployment","Prefer http bearer schemes for header-based API keys"],"tags":["openapi","appsec","api-key","request-validation"],"backgroundTag":"unsupported-operation","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}