crowdsecurity/crowdsec · error

security scheme not supported

Error message

%s security scheme not supported

What it means

The validator cannot enforce oauth2 or openIdConnect security schemes (it only checks presence of http/apiKey credentials). When a request requires such a scheme and the OnUnsupportedSecurityScheme policy is PolicyDrop (the default 'drop'), authFunc fails the request with this error, telling the operator the scheme type is not supported by the WAF.

Solutions

1. Set the OnUnsupportedSecurityScheme schema option to PolicyIgnore ("ignore") so the WAF leaves OAuth enforcement to your application.
2. Declare a scheme the validator can check (http bearer) in the spec if clients use Authorization: Bearer tokens.
3. Verify the warning logged at schema load time ("security scheme ... not supported") and adjust deployment accordingly.
4. Remove the oauth2/openIdConnect security requirement from routes if it does not reflect real client behavior.

Example fix

// before
opts := &api_validation.SchemaOptions{}
rv.LoadSchema(ref, schema, opts)

// after
opts := &api_validation.SchemaOptions{}
opts.OnUnsupportedSecurityScheme = api_validation.PolicyIgnore
rv.LoadSchema(ref, schema, opts)

// refuse oauth2/openIdConnect schemes unless policy is ignore
if opts.OnUnsupportedSecurityScheme != api_validation.PolicyIgnore {
    for name, sr := range doc.Components.SecuritySchemes {
        if sr.Value != nil && (sr.Value.Type == "oauth2" || sr.Value.Type == "openIdConnect") {
            return fmt.Errorf("scheme %q type %s requires PolicyIgnore", name, sr.Value.Type)
        }
    }
}

if err := rv.LoadSchema(ref, schema, opts); err != nil {
    if strings.Contains(err.Error(), "security scheme not supported") {
        opts.OnUnsupportedSecurityScheme = api_validation.PolicyIgnore
        return rv.LoadSchema(ref, schema, opts)
    }
    return err
}

When it happens

Trigger: A client requests a route whose OpenAPI security requirement references a securityScheme of type oauth2 or openIdConnect, and on_unsupported_security_scheme is set to "drop" (or left at its default).

Common situations: Importing an existing API spec that uses OAuth2/OIDC flows; upgrading a schema to add oauth2 security after initial deployment; forgetting to set the ignore policy while the app itself handles OAuth at the application layer.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• unsupported security scheme type
• attempting to load a new schema for existing ref
• auth token is required but not provided
• authorization header not found
• cookie not found

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/96d54c2e088c10de. Report an issue: GitHub.

Appendix: source

Thrown at pkg/appsec/api_validation/api_validation.go:286

				}
				authTokenValue = values[0]
			case "cookie":
				cookieValues := input.RequestValidationInput.Request.CookiesNamed(input.SecurityScheme.Name)
				if len(cookieValues) == 0 {
					return fmt.Errorf("cookie %s not found", input.SecurityScheme.Name)
				}
				if len(cookieValues) > 1 {
					return fmt.Errorf("multiple cookies with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = cookieValues[0].Value
			default:
				return fmt.Errorf("unsupported apiKey location %s", input.SecurityScheme.In)
			}
		case "oauth2", "openIdConnect":
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("%s security scheme not supported", input.SecurityScheme.Type)
		default:
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("unsupported security scheme type %s", input.SecurityScheme.Type)
		}
		if authTokenValue == "" {
			return errors.New("auth token is required but not provided")
		}

		return nil
	}
}

func (rv *RequestValidator) LoadSchema(ref string, schema string, opts *SchemaOptions) error {
	if ref == "" {
		return errors.New("ref cannot be empty")
	}

View on GitHub (pinned to 909b515798)