{"record":{"id":"b955b8add2054565","repo":"crowdsecurity/crowdsec","slug":"failed-to-find-route-for-request-w-error-type","errorCode":null,"errorMessage":"failed to find route for request: %w (error type: %T)","messagePattern":"failed to find route for request: %w \\(error type: %T\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":390,"sourceCode":"\t\t\t\t}\n\t\t\t\treturn &ValidationError{\n\t\t\t\t\tReason:        \"route_not_found\",\n\t\t\t\t\tMessage:       routeErr.Reason,\n\t\t\t\t\tOriginalError: err,\n\t\t\t\t}\n\t\t\tcase routers.ErrMethodNotAllowed.Error():\n\t\t\t\tif schemaData.Options.OnMethodNotAllowed == PolicyIgnore {\n\t\t\t\t\trv.logger.Debugf(\"method %s not allowed for %s, ignoring per schema policy\", r.Method, r.URL.Path)\n\t\t\t\t\treturn nil\n\t\t\t\t}\n\t\t\t\treturn &ValidationError{\n\t\t\t\t\tReason:        \"method_not_allowed\",\n\t\t\t\t\tMessage:       routeErr.Reason,\n\t\t\t\t\tOriginalError: err,\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn fmt.Errorf(\"failed to find route for request: %w (error type: %T)\", err, err)\n\t}\n\n\tinput := &openapi3filter.RequestValidationInput{\n\t\tRequest:     r,\n\t\tQueryParams: r.URL.Query(),\n\t\tRoute:       route,\n\t\tPathParams:  pathParam,\n\t\tOptions: &openapi3filter.Options{\n\t\t\t// Stop at the 1st error, we are a WAF, not an actual schema validator\n\t\t\t// And having multiple errors would make it harder to expose a proper event to the user\n\t\t\tMultiError:         false,\n\t\t\tAuthenticationFunc: rv.authFunc(schemaData.Options.OnUnsupportedSecurityScheme),\n\t\t},\n\t}\n\n\terr = openapi3filter.ValidateRequest(ctx, input)\n\tif err == nil {\n\t\treturn nil","sourceCodeStart":372,"sourceCodeEnd":408,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L372-L408","documentation":"After loading the schema, ValidateRequest asks the OpenAPI legacy router to match the HTTP request (method + path) to a route in the spec. If FindRoute fails with anything other than the handled route_not_found / method_not_allowed RouteError reasons, the error is wrapped as 'failed to find route for request' with the error type appended for debugging. This indicates the router rejected the request in an unexpected way rather than a plain 404/405.","triggerScenarios":"Router.FindRoute returns a non-RouteError error (e.g. malformed request URL, server-mismatch in the spec, or router-internal failure) while matching r against the loaded OpenAPI document; an unhandled routers.RouteError reason code.","commonSituations":"Requests with paths containing malformed escapes or invalid characters that the router cannot parse; OpenAPI spec has servers entries that do not match the request; unusual request URLs (empty path, weird encoding) confusing kin-openapi's router.","solutions":["Read the wrapped error and its %T type in the message to identify the underlying kin-openapi router failure","Log the request method and URL at the failure point and reproduce with a simplified request","Normalize or reject malformed URLs before calling ValidateRequest","If it is a route_not_found/method_not_allowed case, configure OnRouteNotFound / OnMethodNotAllowed policies to control the behavior instead"],"exampleFix":"// before\nif strings.Contains(err.Error(), \"failed to find route\") {\n\tlog.Warn(\"router failure\", err)\n}\n// after\nparsed, perr := url.Parse(req.URL.String())\nif perr != nil || parsed.Path == \"\" {\n\treturn fmt.Errorf(\"skipping validation, malformed url: %q\", req.URL)\n}\nif err := validator.ValidateRequest(ctx, ref, req); err != nil {\n\tlog.Warn(\"route lookup failed\", err)\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Log request URL and error type on router failures","Configure route-not-found policies"],"tags":["openapi","routing","http"],"backgroundTag":"unexpected-response-shape","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}