{"record":{"id":"bc6854ecfaaa09c8","repo":"crowdsecurity/crowdsec","slug":"multiple-authorization-headers-found","errorCode":null,"errorMessage":"multiple Authorization headers found","messagePattern":"multiple Authorization headers found","errorType":"http","errorClass":null,"httpStatus":401,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":229,"sourceCode":"\t\t\trv.logger.Warnf(\"schema %q: security scheme %q (type %s) is not supported and %s for any request that requires it\",\n\t\t\t\tref, name, schemeRef.Value.Type, action)\n\t\t}\n\t}\n}\n\nfunc (*RequestValidator) authFunc(unsupportedPolicy Policy) openapi3filter.AuthenticationFunc {\n\treturn func(_ context.Context, input *openapi3filter.AuthenticationInput) error {\n\t\tauthTokenValue := \"\"\n\t\tswitch input.SecurityScheme.Type {\n\t\tcase \"http\":\n\t\t\tswitch input.SecurityScheme.Scheme {\n\t\t\tcase \"basic\":\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[\"Authorization\"]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn errors.New(\"authorization header not found\")\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn errors.New(\"multiple Authorization headers found\")\n\t\t\t\t}\n\t\t\t\tif !strings.HasPrefix(values[0], \"Basic \") {\n\t\t\t\t\treturn errors.New(\"authorization header does not start with 'Basic '\")\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0][6:]\n\t\t\tcase \"bearer\":\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[\"Authorization\"]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn errors.New(\"authorization header not found\")\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn errors.New(\"multiple Authorization headers found\")\n\t\t\t\t}\n\t\t\t\tif !strings.HasPrefix(values[0], \"Bearer \") {\n\t\t\t\t\treturn errors.New(\"authorization header does not start with 'Bearer '\")\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0][7:]\n\t\t\t}","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L211-L247","documentation":"The validator enforces that a request carries exactly one Authorization header when a basic-auth HTTP security scheme applies. HTTP allows repeated headers, but for Authorization this is always ambiguous/invalid, so the validator rejects it before checking the value.","triggerScenarios":"input.RequestValidationInput.Request.Header[\"Authorization\"] contains more than one value while validating against a securityScheme with type=http, scheme=basic.","commonSituations":"A misconfigured client or proxy appending a second Authorization header (e.g. one from the app and one injected by middleware/gateway); header smuggling attempts; testing frameworks that merge header maps case-insensitively producing duplicates like Authorization/authorization.","solutions":["Ensure the client sends only a single Authorization header","Inspect and fix proxies, gateways, or middleware that inject an extra Authorization header","If this is an attack pattern, treat the rejection as expected WAF behavior and tune rules if it hits legitimate traffic","Normalize header handling in the sending application so case variations don't produce duplicate entries"],"exampleFix":"// before\nreq.Header.Set(\"Authorization\", \"Basic abc\")\nreq.Header.Add(\"Authorization\", \"Basic def\") // second value -> error\n// after\nreq.Header.Set(\"Authorization\", \"Basic abc\")","handlingStrategy":"validation","validationCode":"if n := len(req.Header.Values(\"Authorization\")); n > 1 { return fmt.Errorf(\"request would be rejected: %d Authorization headers\", n) }","typeGuard":null,"tryCatchPattern":"if err := validator.Validate(req); err != nil { if strings.Contains(err.Error(), \"multiple Authorization headers\") { log.Warn(\"duplicate auth header — check middleware\") } }","preventionTips":["Use Header.Set instead of Header.Add for Authorization","Audit middleware/gateways that inject auth headers","Normalize header casing when building requests"],"tags":["http","auth","appsec","headers"],"backgroundTag":"invalid-argument-format","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}