{"record":{"id":"f91da479e9c815fe","repo":"crowdsecurity/crowdsec","slug":"header-s-not-found","errorCode":null,"errorMessage":"header %s not found","messagePattern":"header (.+?) not found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/api_validation/api_validation.go","lineNumber":264,"sourceCode":"\t\t\t\tauthTokenValue = values[0][7:]\n\t\t\t}\n\t\tcase \"apiKey\":\n\t\t\tswitch input.SecurityScheme.In {\n\t\t\tcase \"query\":\n\t\t\t\t//Because we are checking for the presence of the API key, it probably does not matter if go drops parameters using ; as a separator\n\t\t\t\tvalues := input.RequestValidationInput.Request.URL.Query()[input.SecurityScheme.Name]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"query parameter %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple query parameters with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"header\":\n\t\t\t\tcanonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)\n\t\t\t\tvalues := input.RequestValidationInput.Request.Header[canonicalHeaderName]\n\t\t\t\tif len(values) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"header %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(values) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple headers with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = values[0]\n\t\t\tcase \"cookie\":\n\t\t\t\tcookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)\n\t\t\t\tif len(cookieValues) == 0 {\n\t\t\t\t\treturn fmt.Errorf(\"cookie %s not found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tif len(cookieValues) > 1 {\n\t\t\t\t\treturn fmt.Errorf(\"multiple cookies with name %s found\", input.SecurityScheme.Name)\n\t\t\t\t}\n\t\t\t\tauthTokenValue = cookieValues[0].Value\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"unsupported apiKey location %s\", input.SecurityScheme.In)\n\t\t\t}\n\t\tcase \"oauth2\", \"openIdConnect\":","sourceCodeStart":246,"sourceCodeEnd":282,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/api_validation/api_validation.go#L246-L282","documentation":"For header-located apiKey security schemes, the validator looks up the scheme's header name (canonically keyed) in the request headers. If the header is absent, this error is returned because the required API key is missing.","triggerScenarios":"A request validated against a securityScheme with In: \"header\" lacks the named header — len(values) == 0 at pkg/appsec/api_validation/api_validation.go:264.","commonSituations":"Client forgets the Authorization/X-API-Key header; spec header name differs from what the client sends; middleware strips the header.","solutions":["Add the required header with the API key to the request.","Verify the securityScheme Name in the spec matches the header name the client sends (canonical casing).","Check intermediate proxies/middleware for header stripping."],"exampleFix":"// before\nreq, _ := http.NewRequest(\"GET\", url, nil)\n// after\nreq, _ := http.NewRequest(\"GET\", url, nil)\nreq.Header.Set(\"X-API-Key\", apiKey)","handlingStrategy":"validation","validationCode":"if req.Header.Get(\"X-API-Key\") == \"\" { return errors.New(\"X-API-Key header required\") }","typeGuard":null,"tryCatchPattern":"err := validator.ValidateRequest(input); if err != nil { if strings.Contains(err.Error(), \"header\") && strings.Contains(err.Error(), \"not found\") { return ErrMissingAPIKeyHeader } return err }","preventionTips":["Set auth headers in a shared client wrapper so they're never forgotten","Use http.CanonicalHeaderKey for lookups","Verify proxies don't strip custom headers"],"tags":["appsec","openapi","api-key","header","auth"],"backgroundTag":"missing-api-key","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}