crowdsecurity/crowdsec · error

headers is selected, but headers is not provided

Error message

headers is selected, but headers is not provided

What it means

When `auth_type: headers` is selected, Validate() requires the `headers` map to be present. If c.Headers is nil, it returns "headers is selected, but headers is not provided". The auth type declares intent that the config does not back with data.

Source

Thrown at pkg/acquisition/modules/http/config.go:119

	}

	switch c.AuthType {
	case "basic_auth":
		baseErr := "basic_auth is selected, but"
		if c.BasicAuth == nil {
			return errors.New(baseErr + " basic_auth is not provided")
		}

		if c.BasicAuth.Username == "" {
			return errors.New(baseErr + " username is not provided")
		}

		if c.BasicAuth.Password == "" {
			return errors.New(baseErr + " password is not provided")
		}
	case "headers":
		if c.Headers == nil {
			return errors.New("headers is selected, but headers is not provided")
		}
	case "mtls":
		if c.TLS == nil || c.TLS.CaCert == "" {
			return errors.New("mtls is selected, but ca_cert is not provided")
		}
	default:
		return errors.New("invalid auth_type: must be one of basic_auth, headers, mtls")
	}

	if c.TLS != nil {
		if c.TLS.ServerCert == "" {
			return errors.New("server_cert is required")
		}

		if c.TLS.ServerKey == "" {
			return errors.New("server_key is required")
		}
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Add a `headers` map with at least one entry, e.g. `headers: {X-API-Key: mykey}`.
2. Check YAML indentation so `headers:` sits inside the same datasource entry as `auth_type`.
3. Remove or change `auth_type` if header auth is not needed.

Example fix

// before
source: http
auth_type: headers

// after
source: http
auth_type: headers
headers:
  X-API-Key: mykey

if cfg.AuthType == "headers" && len(cfg.Headers) == 0 {
    return errors.New("auth_type headers requires a non-empty headers map")
}

When it happens

Trigger: Set `auth_type: headers` without a `headers:` section, or with the section misnamed/mis-indented so it unmarshals to nil.

Common situations: Users switch from basic_auth to header auth and forget to add the headers block; YAML indentation nests headers under another key; API-key authentication setups where the header block was deleted during editing.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided
• path must start with /
• chunk_size must be positive

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c00484b89186afc5. Report an issue: GitHub.