apache/druid · error · RuntimeException

Decompression failed

Error message

Decompression failed

What it means

Pac4jSessionStore.uncompress wraps GZIP decompression of data read back from a cookie. An IOException from GZIPInputStream means the bytes are not valid GZIP data — typically corrupted, truncated, or produced by a different cipher/encoding step — so it rethrows as RuntimeException.

Solutions

1. Verify the encryption key/secret is unchanged across deployments
2. Ensure session data fits within cookie size limits (compress first, check length)
3. Log and discard invalid session cookies, forcing re-authentication instead of failing the request
4. Wrap uncompressDecryptBase64 in try-catch and treat failure as 'no session'

Example fix

// before
byte[] data = store.uncompressDecryptBase64(cookieValue);
// after
byte[] data;
try {
  data = store.uncompressDecryptBase64(cookieValue);
} catch (RuntimeException e) {
  LOGGER.warn(e, "Invalid session cookie; treating as unauthenticated");
  data = null;
}

// Heuristic pre-check on cookie size before trusting it
if (cookieValue == null || cookieValue.length() > 4096) { /* discard cookie, force re-auth */ }

try { data = store.uncompressDecryptBase64(v); } catch (RuntimeException e) { LOGGER.warn(e, "Invalid session cookie"); clearCookie(); data = null; }

When it happens

Trigger: Calling uncompressDecryptBase64 with cookie bytes that were truncated by the container (cookie size limits), tampered with, encrypted/decrypted with different keys across restarts, or otherwise not valid GZIP stream data.

Common situations: Changing the encryption key between deployments so decrypted bytes are garbage; cookies truncated over the ~4KB browser limit; manual cookie editing; session data written by a different Druid version.

Related errors

• Compression failed
• Cannot list files in directory
• Column capacity exceeded
• Directory compression not supported for
• Directory decompression not supported for

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/9f89c8e0dd3c58dc. Report an issue: GitHub.

Appendix: source

Thrown at extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java:248

    try (ByteArrayOutputStream byteStream = new ByteArrayOutputStream(data.length)) {
      try (GZIPOutputStream gzip = new GZIPOutputStream(byteStream)) {
        gzip.write(data);
      }
      return byteStream.toByteArray();
    }
    catch (IOException ex) {
      throw new RuntimeException("Compression failed", ex);
    }
  }

  private byte[] uncompress(final byte[] data)
  {
    try (ByteArrayInputStream inputStream = new ByteArrayInputStream(data);
         GZIPInputStream gzip = new GZIPInputStream(inputStream)) {
      return ByteStreams.toByteArray(gzip);
    }
    catch (IOException ex) {
      throw new RuntimeException("Decompression failed", ex);
    }
  }

  /**
   * Serialize object using standard Java serialization
   */
  private byte[] serializeToBytes(Serializable obj)
  {
    Preconditions.checkNotNull(obj, "Object to serialize cannot be null");

    try (ByteArrayOutputStream baos = new ByteArrayOutputStream();
         ObjectOutputStream oos = new ObjectOutputStream(baos)) {
      oos.writeObject(obj);
      oos.flush();
      return baos.toByteArray();
    }
    catch (IOException e) {
      throw new RuntimeException("Failed to serialize object", e);

View on GitHub (pinned to 9b90983fd2)