crowdsecurity/crowdsec · error

on_unsupported_security_scheme: %w

Error message

on_unsupported_security_scheme: %w

What it means

LoadSchema validates the OnUnsupportedSecurityScheme policy option, which must be exactly "drop" or "ignore". An invalid value fails options.OnUnsupportedSecurityScheme.validate() and is wrapped as "on_unsupported_security_scheme: ..." before any schema parsing happens.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:319

func (rv *RequestValidator) LoadSchema(ref string, schema string, opts *SchemaOptions) error {
	if ref == "" {
		return errors.New("ref cannot be empty")
	}
	rv.logger.Debugf("loading schema for ref %s", ref)

	if _, exists := rv.loaders[ref]; exists {
		return fmt.Errorf("attempting to load a new schema for existing ref %s", ref)
	}

	options := opts.withDefaults()
	if err := options.OnRouteNotFound.validate(); err != nil {
		return fmt.Errorf("on_route_not_found: %w", err)
	}
	if err := options.OnMethodNotAllowed.validate(); err != nil {
		return fmt.Errorf("on_method_not_allowed: %w", err)
	}
	if err := options.OnUnsupportedSecurityScheme.validate(); err != nil {
		return fmt.Errorf("on_unsupported_security_scheme: %w", err)
	}

	loader := openapi3.NewLoader()
	rv.loaders[ref] = loader

	doc, err := loader.LoadFromData([]byte(schema))
	if err != nil {
		return fmt.Errorf("failed to load schema %s: %w", ref, err)
	}

	// Is it a valid OpenAPI schema?
	// TODO: look into opts, should we expose some of them to the user ?
	if err := doc.Validate(loader.Context, openapi3.DisableExamplesValidation()); err != nil {
		return fmt.Errorf("failed to validate schema %s: %w", ref, err)
	}

	rv.warnUnsupportedSecuritySchemes(ref, doc, options.OnUnsupportedSecurityScheme)

View on GitHub (pinned to 909b515798)

Solutions

1. Set on_unsupported_security_scheme to exactly "drop" or "ignore".
2. Use the PolicyDrop/PolicyIgnore constants in code to avoid string mistakes.
3. Remove the invalid key from the config so the default applies.
4. Grep the appsec config for the key and check its exact spelling/case.

Example fix

// before
on_unsupported_security_scheme: pass

// after
on_unsupported_security_scheme: ignore

if p := string(opts.OnUnsupportedSecurityScheme); p != "drop" && p != "ignore" {
    return fmt.Errorf("bad on_unsupported_security_scheme: %q", p)
}

func isPolicy(s string) bool { return s == "drop" || s == "ignore" }

if err := rv.LoadSchema(ref, schema, opts); err != nil {
    if strings.Contains(err.Error(), "on_unsupported_security_scheme:") {
        log.Errorf("fix on_unsupported_security_scheme (drop|ignore): %v", err)
    }
    return err
}

When it happens

Trigger: Calling LoadSchema with SchemaOptions.OnUnsupportedSecurityScheme set to anything other than "drop"/"ignore" (typo, empty string, capitalization), typically from the on_unsupported_security_scheme key in the appsec config.

Common situations: Typos in YAML config; assuming other policy strings (e.g. "log", "pass", "allow") are valid; explicit empty-string assignment in code instead of leaving the field zero/unset.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• on_route_not_found: %w
• on_method_not_allowed: %w
• missing lapi client credentials
• no appsec_config provided
• missing TLS key file

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/a8e38f737d1bec90. Report an issue: GitHub.