crowdsecurity/crowdsec · error

unsupported security scheme type %s

Error message

unsupported security scheme type %s

What it means

The validator only understands http (basic/bearer) and apiKey security schemes plus the explicitly-handled oauth2/openIdConnect. Any other securityScheme type in the OpenAPI document (e.g. mutualTLS, or an unknown type) causes authFunc to fail request validation with this error, unless the unsupported-scheme policy is set to ignore.

Source

Thrown at pkg/appsec/api_validation/api_validation.go:291

					return fmt.Errorf("cookie %s not found", input.SecurityScheme.Name)
				}
				if len(cookieValues) > 1 {
					return fmt.Errorf("multiple cookies with name %s found", input.SecurityScheme.Name)
				}
				authTokenValue = cookieValues[0].Value
			default:
				return fmt.Errorf("unsupported apiKey location %s", input.SecurityScheme.In)
			}
		case "oauth2", "openIdConnect":
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("%s security scheme not supported", input.SecurityScheme.Type)
		default:
			if unsupportedPolicy == PolicyIgnore {
				return nil
			}
			return fmt.Errorf("unsupported security scheme type %s", input.SecurityScheme.Type)
		}
		if authTokenValue == "" {
			return errors.New("auth token is required but not provided")
		}

		return nil
	}
}

func (rv *RequestValidator) LoadSchema(ref string, schema string, opts *SchemaOptions) error {
	if ref == "" {
		return errors.New("ref cannot be empty")
	}
	rv.logger.Debugf("loading schema for ref %s", ref)

	if _, exists := rv.loaders[ref]; exists {
		return fmt.Errorf("attempting to load a new schema for existing ref %s", ref)
	}

View on GitHub (pinned to 909b515798)

Solutions

1. Set OnUnsupportedSecurityScheme to PolicyIgnore so unrecognized scheme types don't fail requests.
2. Correct the scheme type in the OpenAPI document to one of: http, apiKey, oauth2, openIdConnect.
3. For mTLS, handle certificate verification at the ingress/proxy layer and drop the scheme from the WAF-visible spec.
4. Fix casing typos (e.g. 'apikey' -> 'apiKey') in the securitySchemes section.

Example fix

// before
securitySchemes:
  MTLS:
    type: mutualTLS

// after
securitySchemes:
  MTLS:
    type: http
    scheme: bearer

allowed := map[string]bool{"http": true, "apiKey": true, "oauth2": true, "openIdConnect": true}
for name, sr := range doc.Components.SecuritySchemes {
    if sr.Value != nil && !allowed[sr.Value.Type] {
        return fmt.Errorf("scheme %q has unsupported type %q", name, sr.Value.Type)
    }
}

func supportedSchemeType(t string) bool {
    switch t { case "http", "apiKey", "oauth2", "openIdConnect": return true }
    return false
}

if err := rv.LoadSchema(ref, schema, opts); err != nil {
    if strings.Contains(err.Error(), "unsupported security scheme type") {
        log.Errorf("replace or drop the scheme in the spec: %v", err)
    }
    return err
}

When it happens

Trigger: A request targets a route secured with a securityScheme whose type is not http/apiKey/oauth2/openIdConnect — for instance type: mutualTLS — while OnUnsupportedSecurityScheme is "drop".

Common situations: Specs authored for mTLS-protected APIs; malformed specs with an invalid type value (typos like 'apikey' instead of 'apiKey'); schemas generated by tools emitting non-standard types.

Related errors

• unsupported apiKey location %s
• %s security scheme not supported
• invalid schema name
• authorization header not found
• auth token is required but not provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c50bbc1329c5a913. Report an issue: GitHub.