apache/hadoop · error · AuthenticationException

Invalid authentication token

Error message

Invalid authentication token

What it means

The private split() helper inside AuthToken breaks the token string on '&' and expects every segment to be a 'key=value' pair. Any segment that contains no '=' character means the string is not a well-formed attribute list, and this AuthenticationException is thrown from AuthToken.parse().

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/AuthToken.java:244

  /**
   * Splits the string representation of a token into attributes pairs.
   *
   * @param tokenStr string representation of a token.
   *
   * @return a map with the attribute pairs of the token.
   *
   * @throws AuthenticationException thrown if the string representation of the token could not be broken into
   * attribute pairs.
   */
  private static Map<String, String> split(String tokenStr) throws AuthenticationException {
    Map<String, String> map = new HashMap<String, String>();
    StringTokenizer st = new StringTokenizer(tokenStr, ATTR_SEPARATOR);
    while (st.hasMoreTokens()) {
      String part = st.nextToken();
      int separator = part.indexOf('=');
      if (separator == -1) {
        throw new AuthenticationException("Invalid authentication token");
      }
      String key = part.substring(0, separator);
      String value = part.substring(separator + 1);
      map.put(key, value);
    }
    return map;
  }

}

View on GitHub (pinned to 2add963021)

Solutions

1. URL-encode every attribute value when assembling token or cookie strings so '&' and '=' never appear raw
2. Log the offending segment to find which value introduced the stray '&'
3. Reject the token and redirect the client through re-authentication instead of trying to repair it

Example fix

// before: raw concatenation, principal may contain '&' or '='
String tokenStr = "u=" + user + "&p=" + principal + "&t=hadoop&e=" + exp;

// after: encode each value
String tokenStr = "u=" + URLEncoder.encode(user, UTF_8)
    + "&p=" + URLEncoder.encode(principal, UTF_8)
    + "&t=hadoop&e=" + exp;

boolean segmentsWellFormed(String tokenStr) {
  for (String part : tokenStr.split("&")) {
    if (!part.isEmpty() && !part.substring(1).isEmpty() && part.indexOf('=') < 0) return false;
    if (part.indexOf('=') < 0 && !part.isEmpty()) return false;
  }
  return true;
}

try { AuthToken.parse(str); } catch (AuthenticationException e) { /* reject token, re-authenticate */ }

When it happens

Trigger: AuthToken.parse() receives a string like 'u=alice&garbage' or a bare fragment such as 'u=alice&p' ; an attribute value containing an unencoded '&' is split mid-value and leaves a segment without '='; a cookie value cut at an arbitrary offset by truncation.

Common situations: Building token strings by string concatenation without URL-encoding values that contain '&' or '='; a proxy or framework mangling the cookie (double-decoding, partial rewriting); tampered cookies sent by a client.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid token string, missing attributes
• tokenStr cannot be null
• url cannot be NULL
• url must be for a HTTP or HTTPS resource
• token cannot be NULL

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/c05007cc93e8b590. Report an issue: GitHub.