crowdsecurity/crowdsec · error

multiple Authorization headers found

Error message

multiple Authorization headers found

What it means

The validator enforces that a request carries exactly one Authorization header when a basic-auth HTTP security scheme applies. HTTP allows repeated headers, but for Authorization this is always ambiguous/invalid, so the validator rejects it before checking the value.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:229

			rv.logger.Warnf("schema %q: security scheme %q (type %s) is not supported and %s for any request that requires it",
				ref, name, schemeRef.Value.Type, action)
		}
	}
}

func (*RequestValidator) authFunc(unsupportedPolicy Policy) openapi3filter.AuthenticationFunc {
	return func(_ context.Context, input *openapi3filter.AuthenticationInput) error {
		authTokenValue := ""
		switch input.SecurityScheme.Type {
		case "http":
			switch input.SecurityScheme.Scheme {
			case "basic":
				values := input.RequestValidationInput.Request.Header["Authorization"]
				if len(values) == 0 {
					return errors.New("authorization header not found")
				}
				if len(values) > 1 {
					return errors.New("multiple Authorization headers found")
				}
				if !strings.HasPrefix(values[0], "Basic ") {
					return errors.New("authorization header does not start with 'Basic '")
				}
				authTokenValue = values[0][6:]
			case "bearer":
				values := input.RequestValidationInput.Request.Header["Authorization"]
				if len(values) == 0 {
					return errors.New("authorization header not found")
				}
				if len(values) > 1 {
					return errors.New("multiple Authorization headers found")
				}
				if !strings.HasPrefix(values[0], "Bearer ") {
					return errors.New("authorization header does not start with 'Bearer '")
				}
				authTokenValue = values[0][7:]
			}

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure the client sends only a single Authorization header
2. Inspect and fix proxies, gateways, or middleware that inject an extra Authorization header
3. If this is an attack pattern, treat the rejection as expected WAF behavior and tune rules if it hits legitimate traffic
4. Normalize header handling in the sending application so case variations don't produce duplicate entries

Example fix

// before
req.Header.Set("Authorization", "Basic abc")
req.Header.Add("Authorization", "Basic def") // second value -> error
// after
req.Header.Set("Authorization", "Basic abc")

if n := len(req.Header.Values("Authorization")); n > 1 { return fmt.Errorf("request would be rejected: %d Authorization headers", n) }

if err := validator.Validate(req); err != nil { if strings.Contains(err.Error(), "multiple Authorization headers") { log.Warn("duplicate auth header — check middleware") } }

When it happens

Trigger: input.RequestValidationInput.Request.Header["Authorization"] contains more than one value while validating against a securityScheme with type=http, scheme=basic.

Common situations: A misconfigured client or proxy appending a second Authorization header (e.g. one from the app and one injected by middleware/gateway); header smuggling attempts; testing frameworks that merge header maps case-insensitively producing duplicates like Authorization/authorization.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• authorization header not found
• authorization header does not start with 'Basic '
• authorization header does not start with 'Bearer '
• invalid headers
• auth token is required but not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/bc6854ecfaaa09c8. Report an issue: GitHub.