crowdsecurity/crowdsec · error

authorization header not found

Error message

authorization header not found

What it means

The AppSec request validator validates HTTP requests against an OpenAPI security scheme of type 'http' with scheme 'basic'. When basic-auth validation is configured, the request MUST carry exactly one Authorization header starting with 'Basic '. This error is thrown when the Authorization header is entirely absent from the request.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:226

		}
		switch schemeRef.Value.Type {
		case "oauth2", "openIdConnect":
			rv.logger.Warnf("schema %q: security scheme %q (type %s) is not supported and %s for any request that requires it",
				ref, name, schemeRef.Value.Type, action)
		}
	}
}

func (*RequestValidator) authFunc(unsupportedPolicy Policy) openapi3filter.AuthenticationFunc {
	return func(_ context.Context, input *openapi3filter.AuthenticationInput) error {
		authTokenValue := ""
		switch input.SecurityScheme.Type {
		case "http":
			switch input.SecurityScheme.Scheme {
			case "basic":
				values := input.RequestValidationInput.Request.Header["Authorization"]
				if len(values) == 0 {
					return errors.New("authorization header not found")
				}
				if len(values) > 1 {
					return errors.New("multiple Authorization headers found")
				}
				if !strings.HasPrefix(values[0], "Basic ") {
					return errors.New("authorization header does not start with 'Basic '")
				}
				authTokenValue = values[0][6:]
			case "bearer":
				values := input.RequestValidationInput.Request.Header["Authorization"]
				if len(values) == 0 {
					return errors.New("authorization header not found")
				}
				if len(values) > 1 {
					return errors.New("multiple Authorization headers found")
				}
				if !strings.HasPrefix(values[0], "Bearer ") {
					return errors.New("authorization header does not start with 'Bearer '")

View on GitHub (pinned to 909b515798)

Solutions

1. Send the Authorization header with the request, e.g. curl -u user:pass (curl adds 'Authorization: Basic base64(user:pass)')
2. If the endpoint should be anonymous, update the OpenAPI security scheme so basic auth is not required for this operation
3. Check intermediaries (reverse proxy, ingress, API gateway) for rules that strip or rename the Authorization header
4. If your AppSec config should not enforce this scheme, correct the security scheme loaded into the RequestValidator

Example fix

// before
curl https://api.example.com/protected
// after
curl -u myuser:mypass https://api.example.com/protected

if len(req.Header.Values("Authorization")) == 0 { return errors.New("request would be rejected: missing Authorization header for basic-auth scheme") }

if err := validator.Validate(req); err != nil { if strings.Contains(err.Error(), "authorization header not found") { /* treat as 401, prompt for credentials */ } }

When it happens

Trigger: A request is validated against an API definition whose securityScheme has type=http and scheme=basic, and the incoming request contains no Authorization header at all (input.RequestValidationInput.Request.Header["Authorization"] has length 0).

Common situations: Clients hitting a protected endpoint without credentials; curl/browser requests omitting -u/--header; a proxy or load balancer stripping the Authorization header; anonymous health checks or monitoring probes hitting endpoints that the OpenAPI spec marks as requiring basic auth.

Related errors

• multiple Authorization headers found
• authorization header does not start with 'Basic '
• authorization header does not start with 'Bearer '
• auth token is required but not provided
• query parameter %s not found

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/9074b2517de6b1ac. Report an issue: GitHub.