{"record":{"id":"c50bbc1329c5a913","repo":"crowdsecurity/crowdsec","slug":"unsupported-security-scheme-type-s","errorCode":null,"errorMessage":"unsupported security scheme type %s","messagePattern":"unsupported security scheme type (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":291,"sourceCode":"\t\t\t\t\treturn fmt.Errorf(\"cookie %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(cookieValues) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple cookies with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = cookieValues[0].Value\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"unsupported apiKey location %s\", input.SecurityScheme.In)\n\t\t\t}\n\t\tcase \"oauth2\", \"openIdConnect\":\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"%s security scheme not supported\", input.SecurityScheme.Type)\n\t\tdefault:\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"unsupported security scheme type %s\", input.SecurityScheme.Type)\n\t\t}\n\t\tif authTokenValue == \"\" {\n\t\t\treturn errors.New(\"auth token is required but not provided\")\n\t\t}\n\n\t\treturn nil\n\t}\n}\n\nfunc (rv *RequestValidator) LoadSchema(ref string, schema string, opts *SchemaOptions) error {\n\tif ref == \"\" {\n\t\treturn errors.New(\"ref cannot be empty\")\n\t}\n\trv.logger.Debugf(\"loading schema for ref %s\", ref)\n\n\tif _, exists := rv.loaders[ref]; exists {\n\t\treturn fmt.Errorf(\"attempting to load a new schema for existing ref %s\", ref)\n\t}","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L273-L309","documentation":"The validator only understands http (basic/bearer) and apiKey security schemes plus the explicitly-handled oauth2/openIdConnect. Any other securityScheme type in the OpenAPI document (e.g. mutualTLS, or an unknown type) causes authFunc to fail request validation with this error, unless the unsupported-scheme policy is set to ignore.","triggerScenarios":"A request targets a route secured with a securityScheme whose type is not http/apiKey/oauth2/openIdConnect — for instance type: mutualTLS — while OnUnsupportedSecurityScheme is \"drop\".","commonSituations":"Specs authored for mTLS-protected APIs; malformed specs with an invalid type value (typos like 'apikey' instead of 'apiKey'); schemas generated by tools emitting non-standard types.","solutions":["Set OnUnsupportedSecurityScheme to PolicyIgnore so unrecognized scheme types don't fail requests.","Correct the scheme type in the OpenAPI document to one of: http, apiKey, oauth2, openIdConnect.","For mTLS, handle certificate verification at the ingress/proxy layer and drop the scheme from the WAF-visible spec.","Fix casing typos (e.g. 'apikey' -> 'apiKey') in the securitySchemes section."],"exampleFix":"// before\nsecuritySchemes:\n  MTLS:\n    type: mutualTLS\n\n// after\nsecuritySchemes:\n  MTLS:\n    type: http\n    scheme: bearer","handlingStrategy":"validation","validationCode":"allowed := map[string]bool{\"http\": true, \"apiKey\": true, \"oauth2\": true, \"openIdConnect\": true}\nfor name, sr := range doc.Components.SecuritySchemes {\n    if sr.Value != nil && !allowed[sr.Value.Type] {\n        return fmt.Errorf(\"scheme %q has unsupported type %q\", name, sr.Value.Type)\n    }\n}","typeGuard":"func supportedSchemeType(t string) bool {\n    switch t { case \"http\", \"apiKey\", \"oauth2\", \"openIdConnect\": return true }\n    return false\n}","tryCatchPattern":"if err := rv.LoadSchema(ref, schema, opts); err != nil {\n    if strings.Contains(err.Error(), \"unsupported security scheme type\") {\n        log.Errorf(\"replace or drop the scheme in the spec: %v\", err)\n    }\n    return err\n}","preventionTips":["Use only http/apiKey/oauth2/openIdConnect types in WAF-enforced specs","Watch for casing typos like 'apikey' vs 'apiKey'","Handle mTLS outside the OpenAPI spec consumed by the validator"],"tags":["openapi","appsec","security-scheme","request-validation"],"backgroundTag":"unsupported-enum-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}