crowdsecurity/crowdsec · error

failed to find route for request: %w (error type: %T)

Error message

failed to find route for request: %w (error type: %T)

What it means

After loading the schema, ValidateRequest asks the OpenAPI legacy router to match the HTTP request (method + path) to a route in the spec. If FindRoute fails with anything other than the handled route_not_found / method_not_allowed RouteError reasons, the error is wrapped as 'failed to find route for request' with the error type appended for debugging. This indicates the router rejected the request in an unexpected way rather than a plain 404/405.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:390

				}
				return &ValidationError{
					Reason:        "route_not_found",
					Message:       routeErr.Reason,
					OriginalError: err,
				}
			case routers.ErrMethodNotAllowed.Error():
				if schemaData.Options.OnMethodNotAllowed == PolicyIgnore {
					rv.logger.Debugf("method %s not allowed for %s, ignoring per schema policy", r.Method, r.URL.Path)
					return nil
				}
				return &ValidationError{
					Reason:        "method_not_allowed",
					Message:       routeErr.Reason,
					OriginalError: err,
				}
			}
		}
		return fmt.Errorf("failed to find route for request: %w (error type: %T)", err, err)
	}

	input := &openapi3filter.RequestValidationInput{
		Request:     r,
		QueryParams: r.URL.Query(),
		Route:       route,
		PathParams:  pathParam,
		Options: &openapi3filter.Options{
			// Stop at the 1st error, we are a WAF, not an actual schema validator
			// And having multiple errors would make it harder to expose a proper event to the user
			MultiError:         false,
			AuthenticationFunc: rv.authFunc(schemaData.Options.OnUnsupportedSecurityScheme),
		},
	}

	err = openapi3filter.ValidateRequest(ctx, input)
	if err == nil {
		return nil

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped error and its %T type in the message to identify the underlying kin-openapi router failure
2. Log the request method and URL at the failure point and reproduce with a simplified request
3. Normalize or reject malformed URLs before calling ValidateRequest
4. If it is a route_not_found/method_not_allowed case, configure OnRouteNotFound / OnMethodNotAllowed policies to control the behavior instead

Example fix

// before
if strings.Contains(err.Error(), "failed to find route") {
	log.Warn("router failure", err)
}
// after
parsed, perr := url.Parse(req.URL.String())
if perr != nil || parsed.Path == "" {
	return fmt.Errorf("skipping validation, malformed url: %q", req.URL)
}
if err := validator.ValidateRequest(ctx, ref, req); err != nil {
	log.Warn("route lookup failed", err)
}

When it happens

Trigger: Router.FindRoute returns a non-RouteError error (e.g. malformed request URL, server-mismatch in the spec, or router-internal failure) while matching r against the loaded OpenAPI document; an unhandled routers.RouteError reason code.

Common situations: Requests with paths containing malformed escapes or invalid characters that the router cannot parse; OpenAPI spec has servers entries that do not match the request; unusual request URLs (empty path, weird encoding) confusing kin-openapi's router.

Related errors

• authorization header not found
• path must start with /
• chunk_size must be positive
• invalid HTTP status code
• missing basic auth

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/b955b8add2054565. Report an issue: GitHub.