{"record":{"id":"e05d50acb851eb51","repo":"crowdsecurity/crowdsec","slug":"cookie-s-not-found","errorCode":null,"errorMessage":"cookie %s not found","messagePattern":"cookie (.+?) not found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":273,"sourceCode":"\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple query parameters with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"header\":\n\t\t\t\tcanonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[canonicalHeaderName]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"header %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple headers with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"cookie\":\n\t\t\t\tcookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)\n\t\t\t\tif len(cookieValues) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"cookie %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(cookieValues) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple cookies with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = cookieValues[0].Value\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"unsupported apiKey location %s\", input.SecurityScheme.In)\n\t\t\t}\n\t\tcase \"oauth2\", \"openIdConnect\":\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"%s security scheme not supported\", input.SecurityScheme.Type)\n\t\tdefault:\n\t\t\tif unsupportedPolicy == PolicyIgnore {\n\t\t\t\treturn nil\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"unsupported security scheme type %s\", input.SecurityScheme.Type)","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L255-L291","documentation":"For cookie-located apiKey security schemes, the validator reads the named cookie from the request. If no cookie with that name exists, this error is returned because the required credential is missing.","triggerScenarios":"A request validated against a securityScheme with In: \"cookie\" has no cookie matching input.SecurityScheme.Name — CookiesNamed returns an empty slice at pkg/appsec/api_validation/api_validation.go:273.","commonSituations":"Session cookie expired/deleted so the browser doesn't send it; cookie name in spec differs from the app's cookie; cookie not set on the domain/path of the request.","solutions":["Set the named cookie before making the request (re-authenticate if the session expired).","Confirm the securityScheme Name matches the actual cookie name and domain/path.","Check cookie attributes (Secure, SameSite, Domain) that may prevent the cookie being sent."],"exampleFix":"// before\nreq, _ := http.NewRequest(\"GET\", url, nil)\n// after\nreq.AddCookie(&http.Cookie{Name: \"session\", Value: token})","handlingStrategy":"validation","validationCode":"if _, err := req.Cookie(\"session\"); err != nil { return errors.New(\"session cookie required before calling API\") }","typeGuard":null,"tryCatchPattern":"err := validator.ValidateRequest(input); if err != nil { if strings.Contains(err.Error(), \"cookie\") && strings.Contains(err.Error(), \"not found\") { return ErrMissingCookie } return err }","preventionTips":["Authenticate to obtain the session cookie before API calls","Keep cookie Domain/Path aligned with the API host","Re-login when sessions expire"],"tags":["appsec","openapi","api-key","cookie","auth"],"backgroundTag":"missing-api-key","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}