crowdsecurity/crowdsec · error

basic_auth is selected, but password is not provided

Error message

basic_auth is selected, but password is not provided

What it means

Validation in Configuration.Validate: auth_type is basic_auth and the basic_auth block exists with a username, but its password is empty. HTTP basic auth requires both halves of the credential pair, so the config is rejected before the listener starts.

Source

Thrown at pkg/acquisition/modules/http/config.go:115

	}

	if c.Path[0] != '/' {
		return errors.New("path must start with /")
	}

	switch c.AuthType {
	case "basic_auth":
		baseErr := "basic_auth is selected, but"
		if c.BasicAuth == nil {
			return errors.New(baseErr + " basic_auth is not provided")
		}

		if c.BasicAuth.Username == "" {
			return errors.New(baseErr + " username is not provided")
		}

		if c.BasicAuth.Password == "" {
			return errors.New(baseErr + " password is not provided")
		}
	case "headers":
		if c.Headers == nil {
			return errors.New("headers is selected, but headers is not provided")
		}
	case "mtls":
		if c.TLS == nil || c.TLS.CaCert == "" {
			return errors.New("mtls is selected, but ca_cert is not provided")
		}
	default:
		return errors.New("invalid auth_type: must be one of basic_auth, headers, mtls")
	}

	if c.TLS != nil {
		if c.TLS.ServerCert == "" {
			return errors.New("server_cert is required")
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Set `basic_auth.password` to the actual password.
2. Verify any env-var interpolation (e.g. ${PASSWORD}) resolves to a non-empty value before crowdsec starts.
3. Check that the secret is mounted/available in the environment the service runs in.
4. Switch auth_type if the endpoint does not actually require a password.

Example fix

// before
basic_auth:
  username: user

// after
basic_auth:
  username: user
  password: secret

if cfg.AuthType == "basic_auth" && (cfg.BasicAuth == nil || cfg.BasicAuth.Password == "") {
    return errors.New("basic_auth requires a non-empty password")
}

When it happens

Trigger: The `basic_auth` block has a username but the `password` key is missing, empty, or its env-var/secret interpolation resolves to empty at validation time.

Common situations: Users deliberately omit the password hoping for a prompt (there is none); secrets manager mounts the password under a different key; YAML quoting issues turn the value into an empty string.

Related errors

• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• headers is selected, but headers is not provided
• path must start with /
• chunk_size must be positive

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a15ecb78876b8c07. Report an issue: GitHub.