crowdsecurity/crowdsec · error

authorization header does not start with 'Basic '

Error message

authorization header does not start with 'Basic '

What it means

For a basic-auth security scheme, the validator requires the Authorization header value to begin with the exact prefix 'Basic ' (capital B, one space). A header present and singular but with a different scheme or casing fails this check.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:232

	}
}

func (*RequestValidator) authFunc(unsupportedPolicy Policy) openapi3filter.AuthenticationFunc {
	return func(_ context.Context, input *openapi3filter.AuthenticationInput) error {
		authTokenValue := ""
		switch input.SecurityScheme.Type {
		case "http":
			switch input.SecurityScheme.Scheme {
			case "basic":
				values := input.RequestValidationInput.Request.Header["Authorization"]
				if len(values) == 0 {
					return errors.New("authorization header not found")
				}
				if len(values) > 1 {
					return errors.New("multiple Authorization headers found")
				}
				if !strings.HasPrefix(values[0], "Basic ") {
					return errors.New("authorization header does not start with 'Basic '")
				}
				authTokenValue = values[0][6:]
			case "bearer":
				values := input.RequestValidationInput.Request.Header["Authorization"]
				if len(values) == 0 {
					return errors.New("authorization header not found")
				}
				if len(values) > 1 {
					return errors.New("multiple Authorization headers found")
				}
				if !strings.HasPrefix(values[0], "Bearer ") {
					return errors.New("authorization header does not start with 'Bearer '")
				}
				authTokenValue = values[0][7:]
			}
		case "apiKey":
			switch input.SecurityScheme.In {
			case "query":

View on GitHub (pinned to 909b515798)

Solutions

1. Format the header as 'Authorization: Basic <base64(user:password)>', with capital B and a space
2. Fix client auth config: if you intended bearer tokens, update the OpenAPI security scheme to scheme=bearer instead
3. Generate credentials with standard tooling (curl -u, or base64.StdEncoding of 'user:pass') to avoid formatting mistakes
4. Check for proxies that rewrite or truncate the header value

Example fix

// before
req.Header.Set("Authorization", "basic " + base64.StdEncoding.EncodeToString([]byte("u:p")))
// after
req.Header.Set("Authorization", "Basic " + base64.StdEncoding.EncodeToString([]byte("u:p")))

v := req.Header.Get("Authorization"); if !strings.HasPrefix(v, "Basic ") { return fmt.Errorf("expected 'Basic ' prefix, got %q", v) }

if err := validator.Validate(req); err != nil { if strings.Contains(err.Error(), "does not start with 'Basic '") { /* fix client auth scheme */ } }

When it happens

Trigger: A request with exactly one Authorization header whose value does not start with "Basic " while validated against type=http, scheme=basic — e.g. 'Bearer x', 'basic x' (lowercase), or 'Basicx'.

Common situations: Client configured for bearer auth while the API spec expects basic; lowercase 'basic' from hand-rolled auth code; missing space after the scheme; token accidentally pasted without the scheme prefix.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• authorization header not found
• multiple Authorization headers found
• authorization header does not start with 'Bearer '
• missing basic auth
• invalid basic auth

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/84005ff6e5f56bd7. Report an issue: GitHub.