apache/hadoop · error · SignerException

Invalid signature

Error message

Invalid signature

What it means

The final signature check in Signer: checkSignatures() recomputes HMAC-SHA256 over the raw value with every known secret (current and previously rolled-over ones, compared constant-time via MessageDigest.isEqual). If none matches the signature carried after '&s=', SignerException('Invalid signature') is thrown — the value was tampered with, or it was signed with a secret this server does not know.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/Signer.java:120

  protected void checkSignatures(String rawValue, String originalSignature)
      throws SignerException {
    byte[] orginalSignatureBytes = StringUtils.getBytesUtf8(originalSignature);
    boolean isValid = false;
    byte[][] secrets = secretProvider.getAllSecrets();
    for (int i = 0; i < secrets.length; i++) {
      byte[] secret = secrets[i];
      if (secret != null) {
        String currentSignature = computeSignature(secret, rawValue);
        if (MessageDigest.isEqual(orginalSignatureBytes,
            StringUtils.getBytesUtf8(currentSignature))) {
          isValid = true;
          break;
        }
      }
    }
    if (!isValid) {
      throw new SignerException("Invalid signature");
    }
  }
}

View on GitHub (pinned to 2add963021)

Solutions

1. Treat as unauthenticated: clear the hadoop.auth cookie and redirect to re-authentication
2. If it happens fleet-wide after rotation, align secrets on all nodes (or adopt ZKSignerSecretProvider for automatic sharing)
3. Verify the secret material (signature.secret.file content) matches across servers byte-for-byte

Example fix

// before
String raw = signer.verifyAndExtract(signed);

// after: fail closed and force re-login on any SignerException
try {
  String raw = signer.verifyAndExtract(signed);
} catch (SignerException e) {
  resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
  resp.addHeader("Set-Cookie", "hadoop.auth=; Max-Age=0; Path=/; HttpOnly");
  return;
}

try { String raw = signer.verifyAndExtract(signed); } catch (SignerException e) { /* tampering or secret mismatch: 401, expire hadoop.auth cookie, re-authenticate */ }

When it happens

Trigger: verifyAndExtract() on a cookie whose payload was edited after signing; secret rotation where servers in the cluster disagree (a node still on an old secret or vice versa beyond the rollover window); a cookie minted by a completely different deployment.

Common situations: Manual cookie tampering attempts; inconsistent signature.secret across nodes or missing ZooKeeper-based secret sharing (ZKSignerSecretProvider not used in a HA cluster); clock/rollover skew during secret rotation.

Related errors

• Invalid signed text: {}
• Unauthorized access
• Invalid token string, missing attributes
• secretProvider cannot be NULL
• NULL or empty string to sign

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/cb30f7248329283a. Report an issue: GitHub.