{"record":{"id":"f6cbdd382b1dab42","repo":"crowdsecurity/crowdsec","slug":"invalid-basic-auth","errorCode":null,"errorMessage":"invalid basic auth","messagePattern":"invalid basic auth","errorType":"http","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/acquisition/modules/http/run.go","lineNumber":35,"sourceCode":"\tlog \"github.com/sirupsen/logrus\"\n\t\"gopkg.in/tomb.v2\"\n\n\t\"github.com/crowdsecurity/go-cs-lib/trace\"\n\n\t\"github.com/crowdsecurity/crowdsec/pkg/csnet\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/metrics\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/pipeline\"\n)\n\nfunc authorizeRequest(r *http.Request, hc *Configuration) error {\n\tif hc.AuthType == \"basic_auth\" {\n\t\tusername, password, ok := r.BasicAuth()\n\t\tif !ok {\n\t\t\treturn errors.New(\"missing basic auth\")\n\t\t}\n\n\t\tif username != hc.BasicAuth.Username || password != hc.BasicAuth.Password {\n\t\t\treturn errors.New(\"invalid basic auth\")\n\t\t}\n\t}\n\n\tif hc.AuthType == \"headers\" {\n\t\tfor key, value := range hc.Headers {\n\t\t\tif r.Header.Get(key) != value {\n\t\t\t\treturn errors.New(\"invalid headers\")\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc rejectBody(w http.ResponseWriter, err error) error {\n\tif maxBytesErr, ok := errors.AsType[*http.MaxBytesError](err); ok {\n\t\tw.WriteHeader(http.StatusRequestEntityTooLarge)\n\t\treturn fmt.Errorf(\"body size exceeds max body size: %d\", maxBytesErr.Limit)","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/http/run.go#L17-L53","documentation":"With auth_type: basic_auth, authorizeRequest() (pkg/acquisition/modules/http/run.go:35) compares the request's username and password against the configured BasicAuth.Username/Password. A well-formed Basic header whose credentials do not match the configured pair is rejected with 'invalid basic auth'.","triggerScenarios":"Sending a syntactically valid Basic Authorization header to an http source whose configured basic_auth.username/basic_auth.password differ from the sent credentials.","commonSituations":"Credentials rotated in one place but not the other; typos or trailing whitespace/newline in the YAML password; client URL contains URL-encoded special characters that don't decode to the configured password.","solutions":["Verify the client's username/password exactly match basic_auth.username and basic_auth.password in the source config; test with curl -u.","Check for trailing whitespace or quoting issues in the YAML password; quote the value if it contains special characters.","If credentials are stored in an env-var-injected template, confirm the variable resolves to the expected value.","Update the config after a credential rotation and restart/reload the source."],"exampleFix":"// before (acquis.yaml)\nauth_type: basic_auth\nbasic_auth:\n  username: logreader\n  password: s3cret \n\n// after (no trailing space, matching client creds)\nauth_type: basic_auth\nbasic_auth:\n  username: logreader\n  password: \"s3cret\"","handlingStrategy":"validation","validationCode":"u, p, _ := r.BasicAuth()\nif u != cfg.BasicAuth.Username || p != cfg.BasicAuth.Password {\n    // credentials mismatch; align client creds with config before sending\n}","typeGuard":"func credsMatch(r *http.Request, want struct{ User, Pass string }) bool {\n    u, p, ok := r.BasicAuth()\n    return ok && u == want.User && p == want.Pass\n}","tryCatchPattern":"if err := authorizeRequest(req, cfg); err != nil {\n    if err.Error() == \"invalid basic auth\" {\n        // re-sync credentials between client and source config\n    }\n}","preventionTips":["Store credentials once (secret manager/env) and reference from both sides.","Quote YAML passwords with special characters to avoid parsing surprises.","After rotation, update client and server together and test with curl -u."],"tags":["http","authentication","basic-auth","credentials"],"backgroundTag":"authentication-required","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}