crowdsecurity/crowdsec · warning

invalid basic auth

Error message

invalid basic auth

What it means

With auth_type: basic_auth, authorizeRequest() (pkg/acquisition/modules/http/run.go:35) compares the request's username and password against the configured BasicAuth.Username/Password. A well-formed Basic header whose credentials do not match the configured pair is rejected with 'invalid basic auth'.

Source

Thrown at pkg/acquisition/modules/http/run.go:35

	log "github.com/sirupsen/logrus"
	"gopkg.in/tomb.v2"

	"github.com/crowdsecurity/go-cs-lib/trace"

	"github.com/crowdsecurity/crowdsec/pkg/csnet"
	"github.com/crowdsecurity/crowdsec/pkg/metrics"
	"github.com/crowdsecurity/crowdsec/pkg/pipeline"
)

func authorizeRequest(r *http.Request, hc *Configuration) error {
	if hc.AuthType == "basic_auth" {
		username, password, ok := r.BasicAuth()
		if !ok {
			return errors.New("missing basic auth")
		}

		if username != hc.BasicAuth.Username || password != hc.BasicAuth.Password {
			return errors.New("invalid basic auth")
		}
	}

	if hc.AuthType == "headers" {
		for key, value := range hc.Headers {
			if r.Header.Get(key) != value {
				return errors.New("invalid headers")
			}
		}
	}

	return nil
}

func rejectBody(w http.ResponseWriter, err error) error {
	if maxBytesErr, ok := errors.AsType[*http.MaxBytesError](err); ok {
		w.WriteHeader(http.StatusRequestEntityTooLarge)
		return fmt.Errorf("body size exceeds max body size: %d", maxBytesErr.Limit)

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the client's username/password exactly match basic_auth.username and basic_auth.password in the source config; test with curl -u.
2. Check for trailing whitespace or quoting issues in the YAML password; quote the value if it contains special characters.
3. If credentials are stored in an env-var-injected template, confirm the variable resolves to the expected value.
4. Update the config after a credential rotation and restart/reload the source.

Example fix

// before (acquis.yaml)
auth_type: basic_auth
basic_auth:
  username: logreader
  password: s3cret 

// after (no trailing space, matching client creds)
auth_type: basic_auth
basic_auth:
  username: logreader
  password: "s3cret"

u, p, _ := r.BasicAuth()
if u != cfg.BasicAuth.Username || p != cfg.BasicAuth.Password {
    // credentials mismatch; align client creds with config before sending
}

func credsMatch(r *http.Request, want struct{ User, Pass string }) bool {
    u, p, ok := r.BasicAuth()
    return ok && u == want.User && p == want.Pass
}

if err := authorizeRequest(req, cfg); err != nil {
    if err.Error() == "invalid basic auth" {
        // re-sync credentials between client and source config
    }
}

When it happens

Trigger: Sending a syntactically valid Basic Authorization header to an http source whose configured basic_auth.username/basic_auth.password differ from the sent credentials.

Common situations: Credentials rotated in one place but not the other; typos or trailing whitespace/newline in the YAML password; client URL contains URL-encoded special characters that don't decode to the configured password.

Related errors

• missing basic auth
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided
• invalid headers

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f6cbdd382b1dab42. Report an issue: GitHub.