crowdsecurity/crowdsec · warning

missing basic auth

Error message

missing basic auth

What it means

The HTTP source configured with auth_type: basic_auth acts as a server that authenticates incoming requests. authorizeRequest() (pkg/acquisition/modules/http/run.go:31) parses the request's Authorization header via r.BasicAuth(); if the header is absent or malformed (not 'Basic base64(user:pass)'), the request is rejected with 'missing basic auth' before any credentials are compared.

Source

Thrown at pkg/acquisition/modules/http/run.go:31

	"os"
	"time"

	"github.com/prometheus/client_golang/prometheus"
	log "github.com/sirupsen/logrus"
	"gopkg.in/tomb.v2"

	"github.com/crowdsecurity/go-cs-lib/trace"

	"github.com/crowdsecurity/crowdsec/pkg/csnet"
	"github.com/crowdsecurity/crowdsec/pkg/metrics"
	"github.com/crowdsecurity/crowdsec/pkg/pipeline"
)

func authorizeRequest(r *http.Request, hc *Configuration) error {
	if hc.AuthType == "basic_auth" {
		username, password, ok := r.BasicAuth()
		if !ok {
			return errors.New("missing basic auth")
		}

		if username != hc.BasicAuth.Username || password != hc.BasicAuth.Password {
			return errors.New("invalid basic auth")
		}
	}

	if hc.AuthType == "headers" {
		for key, value := range hc.Headers {
			if r.Header.Get(key) != value {
				return errors.New("invalid headers")
			}
		}
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Add the Basic Authorization header to the client request, e.g. curl -u user:password http://host:port/.
2. Check the client actually uses basic auth, matching the configured auth_type: basic_auth (not digest/bearer/headers).
3. If a proxy sits in between, ensure it forwards the Authorization header.
4. If no auth is desired, change the source config auth_type away from basic_auth.

Example fix

// before
curl http://localhost:8080/logs

// after
curl -u myuser:mypass http://localhost:8080/logs

u, p, ok := r.BasicAuth()
if !ok {
    // request lacks a well-formed Basic Authorization header; add it before sending
}
_ = u
_ = p

func hasBasicAuth(r *http.Request) bool { _, _, ok := r.BasicAuth(); return ok }

if err := authorizeRequest(req, cfg); err != nil {
    if err.Error() == "missing basic auth" {
        // fix client: attach -u user:pass / Authorization: Basic base64(user:pass)
    }
}

When it happens

Trigger: Sending an HTTP request to a crowdsec http source configured with auth_type: basic_auth without an Authorization header, or with a malformed one (wrong scheme, non-base64 payload).

Common situations: Client (curl, log shipper, webhook sender) was never given credentials; client uses bearer/token auth instead of basic; a proxy strips the Authorization header.

Related errors

• invalid basic auth
• basic_auth is selected, but basic_auth is not provided
• basic_auth is selected, but username is not provided
• basic_auth is selected, but password is not provided
• invalid headers

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6654a20ca17d8292. Report an issue: GitHub.