crowdsecurity/crowdsec · error

schema option %q must be a string, got %T

Error message

schema option %q must be a string, got %T

What it means

parseSchemaOptions received a non-string value for a named appsec schema option (on_route_not_found, on_method_not_allowed, on_unsupported_security_scheme). All recognized options are string policies, so any other Go type (number, bool, map) means the config layer passed a wrongly-typed option value; %T shows the actual type.

Source

Thrown at pkg/appsec/appsec.go:1923

}

// RegisterAPISchemaBodyDecoder allows a user's on_load hook to add a Content-Type
// to the set the API schema validator can decode. decoderName must be one of
// the stable built-in identifiers exported by the api_validation package
// ("json", "urlencoded", "multipart", "yaml", "csv", "plain", "file"). Note
// that the underlying kin-openapi decoder registry is process-global: today
// all appsec datasources in the same process share the same set of
// registered body decoders.
func (w *AppsecRuntimeConfig) RegisterAPISchemaBodyDecoder(contentType, decoderName string) error {
	return w.RequestValidator.RegisterBodyDecoder(contentType, decoderName)
}

func parseSchemaOptions(opts map[string]any) (*apivalidation.SchemaOptions, error) {
	out := &apivalidation.SchemaOptions{}
	for k, v := range opts {
		s, ok := v.(string)
		if !ok {
			return nil, fmt.Errorf("schema option %q must be a string, got %T", k, v)
		}
		switch k {
		case "on_route_not_found":
			out.OnRouteNotFound = apivalidation.Policy(s)
		case "on_method_not_allowed":
			out.OnMethodNotAllowed = apivalidation.Policy(s)
		case "on_unsupported_security_scheme":
			out.OnUnsupportedSecurityScheme = apivalidation.Policy(s)
		default:
			return nil, fmt.Errorf("unknown schema option %q", k)
		}
	}
	return out, nil
}

// validationErrorVarKeys lists the keys published into state.HookVars by
// ValidateRequestWithSchema. Keeping them centralized makes it easy to reset
// them all at the start of each validation call.

View on GitHub (pinned to 909b515798)

Solutions

1. Fix the appsec config: schema options like on_route_not_found must be quoted strings ("drop" or "ignore")
2. Check for YAML quoting issues — a bare value parsed as a non-string lands here

When it happens

Trigger: Thrown at pkg/appsec/appsec.go:1923 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e32cefc6a11ca98f. Report an issue: GitHub.