apache/hadoop · error · SignerException

Invalid signed text: {}

Error message

Invalid signed text: {}

What it means

Signer.verifyAndExtract() splits a signed string on the last occurrence of the '&s=' delimiter that separates the payload from its signature. If the delimiter is absent, the string was never produced by Signer.sign(), and SignerException('Invalid signed text: ...') is thrown, echoing the input.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/Signer.java:75

    }
    byte[] secret = secretProvider.getCurrentSecret();
    String signature = computeSignature(secret, str);
    return str + SIGNATURE + signature;
  }

  /**
   * Verifies a signed string and extracts the original string.
   *
   * @param signedStr the signed string to verify and extract.
   *
   * @return the extracted original string.
   *
   * @throws SignerException thrown if the given string is not a signed string or if the signature is invalid.
   */
  public String verifyAndExtract(String signedStr) throws SignerException {
    int index = signedStr.lastIndexOf(SIGNATURE);
    if (index == -1) {
      throw new SignerException("Invalid signed text: " + signedStr);
    }
    String originalSignature = signedStr.substring(index + SIGNATURE.length());
    String rawValue = signedStr.substring(0, index);
    checkSignatures(rawValue, originalSignature);
    return rawValue;
  }

  /**
   * Returns then signature of a string.
   *
   * @param secret The secret to use
   * @param str string to sign.
   *
   * @return the signature for the string.
   */
  protected String computeSignature(byte[] secret, String str) {
    try {
      SecretKeySpec key = new SecretKeySpec((secret), SIGNING_ALGORITHM);

View on GitHub (pinned to 2add963021)

Solutions

1. Only pass values that came from Signer.sign() — check for the '&s=' segment first
2. On this exception, discard the cookie and re-authenticate the client
3. If cookies keep arriving unsigned, audit for clients or tools writing their own hadoop.auth value

Example fix

// before
String raw = signer.verifyAndExtract(cookie.getValue());

// after: pre-check, then treat failure as re-authentication
String value = cookie.getValue();
if (value == null || !value.contains(SignerSignatures.SIGNATURE_SEPARATOR)) {
  // not a signed value -> force re-login
}
String raw = signer.verifyAndExtract(value);

boolean looksSigned(String s) { return s != null && s.contains("&s="); }

try { String raw = signer.verifyAndExtract(v); } catch (SignerException e) { /* unsigned/foreign value: clear cookie, redirect to re-authentication */ }

When it happens

Trigger: Calling verifyAndExtract() on a raw unsigned token (no '&s=<hmac>' suffix), a cookie that was truncated before the signature, or a value from a different/older signer format (e.g. pre-HmacSHA256 rollover artifacts).

Common situations: Clients sending self-made 'hadoop.auth' cookie values; proxies stripping query-like suffixes; stale cookies from a previous deployment surviving a secret change but losing structure; test fixtures with hand-written cookies.

Related errors

• Invalid signature
• Unauthorized access
• Invalid token string, missing attributes
• secretProvider cannot be NULL
• NULL or empty string to sign

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/a64e105a8c792440. Report an issue: GitHub.