What causes "cookie %s not found" in crowdsecurity/crowdsec?

Set the named cookie before making the request (re-authenticate if the session expired).

cookie %s not found

Error message

cookie %s not found

What it means

For cookie-located apiKey security schemes, the validator reads the named cookie from the request. If no cookie with that name exists, this error is returned because the required credential is missing.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:273

				}
				if len(values) > 1 {
					return fmt.Errorf("multiple query parameters with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = values[0]
			case "header":
				canonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)
				values := input.RequestValidationInput.Request.Header[canonicalHeaderName]
				if len(values) == 0 {
					return fmt.Errorf("header %s not found", input.SecurityScheme.Name)
				}
				if len(values) > 1 {
					return fmt.Errorf("multiple headers with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = values[0]
			case "cookie":
				cookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)
				if len(cookieValues) == 0 {
					return fmt.Errorf("cookie %s not found", input.SecurityScheme.Name)
				}
				if len(cookieValues) > 1 {
					return fmt.Errorf("multiple cookies with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = cookieValues[0].Value
			default:
				return fmt.Errorf("unsupported apiKey location %s", input.SecurityScheme.In)
			}
		case "oauth2", "openIdConnect":
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("%s security scheme not supported", input.SecurityScheme.Type)
		default:
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("unsupported security scheme type %s", input.SecurityScheme.Type)

View on GitHub (pinned to 909b515798)

Solutions

Set the named cookie before making the request (re-authenticate if the session expired).
Confirm the securityScheme Name matches the actual cookie name and domain/path.
Check cookie attributes (Secure, SameSite, Domain) that may prevent the cookie being sent.

Example fix

// before
req, _ := http.NewRequest("GET", url, nil)
// after
req.AddCookie(&http.Cookie{Name: "session", Value: token})

Defensive patterns

Strategy: validation

Validate before calling

if _, err := req.Cookie("session"); err != nil { return errors.New("session cookie required before calling API") }

Try / catch

err := validator.ValidateRequest(input); if err != nil { if strings.Contains(err.Error(), "cookie") && strings.Contains(err.Error(), "not found") { return ErrMissingCookie } return err }

Prevention

Authenticate to obtain the session cookie before API calls
Keep cookie Domain/Path aligned with the API host
Re-login when sessions expire

When it happens

Trigger: A request validated against a securityScheme with In: "cookie" has no cookie matching input.SecurityScheme.Name — CookiesNamed returns an empty slice at pkg/appsec/api_validation/api_validation.go:273.

Common situations: Session cookie expired/deleted so the browser doesn't send it; cookie name in spec differs from the app's cookie; cookie not set on the domain/path of the request.

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e05d50acb851eb51. Report an issue: GitHub.