What causes "multiple query parameters with name %s found" in crowdsecurity/crowdsec?

Send the API key query parameter exactly once in the request URL.

multiple query parameters with name %s found

Error message

multiple query parameters with name %s found

What it means

For query-located apiKey security schemes, the validator expects exactly one value for the named query parameter. If the URL query contains the parameter more than once, the value is ambiguous and this error is returned.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:257

				}
				if len(values) > 1 {
					return errors.New("multiple Authorization headers found")
				}
				if !strings.HasPrefix(values[0], "Bearer ") {
					return errors.New("authorization header does not start with 'Bearer '")
				}
				authTokenValue = values[0][7:]
			}
		case "apiKey":
			switch input.SecurityScheme.In {
			case "query":
				//Because we are checking for the presence of the API key, it probably does not matter if go drops parameters using ; as a separator
				values := input.RequestValidationInput.Request.URL.Query()[input.SecurityScheme.Name]
				if len(values) == 0 {
					return fmt.Errorf("query parameter %s not found", input.SecurityScheme.Name)
				}
				if len(values) > 1 {
					return fmt.Errorf("multiple query parameters with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = values[0]
			case "header":
				canonicalHeaderName := http.CanonicalHeaderKey(input.SecurityScheme.Name)
				values := input.RequestValidationInput.Request.Header[canonicalHeaderName]
				if len(values) == 0 {
					return fmt.Errorf("header %s not found", input.SecurityScheme.Name)
				}
				if len(values) > 1 {
					return fmt.Errorf("multiple headers with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = values[0]
			case "cookie":
				cookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)
				if len(cookieValues) == 0 {
					return fmt.Errorf("cookie %s not found", input.SecurityScheme.Name)
				}
				if len(cookieValues) > 1 {

View on GitHub (pinned to 909b515798)

Solutions

Send the API key query parameter exactly once in the request URL.
Inspect any redirect/proxy logic that may append query parameters twice.
If testing HPP behavior, expect this rejection — send a single-valued parameter.

Example fix

// before
url := "/resource?api_key=a&api_key=b"
// after
url := "/resource?api_key=a"

Defensive patterns

Strategy: validation

Validate before calling

if len(u.Query()["api_key"]) != 1 { return errors.New("api_key must appear exactly once") }

Try / catch

err := validator.ValidateRequest(input); if err != nil { if strings.Contains(err.Error(), "multiple query parameters") { return ErrDuplicateParam } return err }

Prevention

Use url.Values and Encode() to build query strings exactly once
Check redirect logic for re-appended parameters
Never manually concatenate query strings

When it happens

Trigger: A validated request's URL contains the apiKey query parameter two or more times (len(values) > 1) at pkg/appsec/api_validation/api_validation.go:257.

Common situations: Client or proxy appends the key twice (e.g. a redirect that re-appends parameters); templating bug duplicating the query string; HPP probes from an attacker.

Understand the failure class

Background: "Invalid query parameter" / "Failed to parse value of ...": fixing bad query string parameters across APIs — this error's family across 36 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/614bf2338af9f7ea. Report an issue: GitHub.