{"record":{"id":"a15ecb78876b8c07","repo":"crowdsecurity/crowdsec","slug":"basic-auth-is-selected-but-password-is-not-provid","errorCode":null,"errorMessage":"basic_auth is selected, but password is not provided","messagePattern":"basic_auth is selected, but password is not provided","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/http/config.go","lineNumber":115,"sourceCode":"\t}\n\n\tif c.Path[0] != '/' {\n\t\treturn errors.New(\"path must start with /\")\n\t}\n\n\tswitch c.AuthType {\n\tcase \"basic_auth\":\n\t\tbaseErr := \"basic_auth is selected, but\"\n\t\tif c.BasicAuth == nil {\n\t\t\treturn errors.New(baseErr + \" basic_auth is not provided\")\n\t\t}\n\n\t\tif c.BasicAuth.Username == \"\" {\n\t\t\treturn errors.New(baseErr + \" username is not provided\")\n\t\t}\n\n\t\tif c.BasicAuth.Password == \"\" {\n\t\t\treturn errors.New(baseErr + \" password is not provided\")\n\t\t}\n\tcase \"headers\":\n\t\tif c.Headers == nil {\n\t\t\treturn errors.New(\"headers is selected, but headers is not provided\")\n\t\t}\n\tcase \"mtls\":\n\t\tif c.TLS == nil || c.TLS.CaCert == \"\" {\n\t\t\treturn errors.New(\"mtls is selected, but ca_cert is not provided\")\n\t\t}\n\tdefault:\n\t\treturn errors.New(\"invalid auth_type: must be one of basic_auth, headers, mtls\")\n\t}\n\n\tif c.TLS != nil {\n\t\tif c.TLS.ServerCert == \"\" {\n\t\t\treturn errors.New(\"server_cert is required\")\n\t\t}\n","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/config.go#L97-L133","documentation":"Validation in Configuration.Validate: auth_type is basic_auth and the basic_auth block exists with a username, but its password is empty. HTTP basic auth requires both halves of the credential pair, so the config is rejected before the listener starts.","triggerScenarios":"The `basic_auth` block has a username but the `password` key is missing, empty, or its env-var/secret interpolation resolves to empty at validation time.","commonSituations":"Users deliberately omit the password hoping for a prompt (there is none); secrets manager mounts the password under a different key; YAML quoting issues turn the value into an empty string.","solutions":["Set `basic_auth.password` to the actual password.","Verify any env-var interpolation (e.g. ${PASSWORD}) resolves to a non-empty value before crowdsec starts.","Check that the secret is mounted/available in the environment the service runs in.","Switch auth_type if the endpoint does not actually require a password."],"exampleFix":"// before\nbasic_auth:\n  username: user\n\n// after\nbasic_auth:\n  username: user\n  password: secret","handlingStrategy":"validation","validationCode":"if cfg.AuthType == \"basic_auth\" && (cfg.BasicAuth == nil || cfg.BasicAuth.Password == \"\") {\n    return errors.New(\"basic_auth requires a non-empty password\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Inject secrets via env vars or secret files and confirm they are mounted before start.","Do not leave password placeholders empty; fail fast with a pre-start check.","Quote YAML values that could be parsed as empty or numeric."],"tags":["config","validation","authentication","basic-auth","secrets"],"backgroundTag":"missing-credentials","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}