apache/hadoop · critical · RuntimeException

No secret in HttpFs signature secret file: {0}

Error message

No secret in HttpFs signature secret file: {0}

What it means

HttpFSAuthenticationFilter reads the file named by httpfs.authentication.signature.secret.file and uses its full contents as the cookie-signing secret for hadoop-auth. If the file is readable but empty, filter init throws RuntimeException('No secret in HttpFs signature secret file: <path>') and the webapp fails to start.

Source

Thrown at hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSAuthenticationFilter.java:97

    String signatureSecretFile = props.getProperty(SIGNATURE_SECRET_FILE, null);
    if (signatureSecretFile == null) {
      throw new RuntimeException("Undefined property: "
          + SIGNATURE_SECRET_FILE);
    }

    if (!isRandomSecret(filterConfig)) {
      try (Reader reader = new InputStreamReader(Files.newInputStream(
          Paths.get(signatureSecretFile)), StandardCharsets.UTF_8)) {
        StringBuilder secret = new StringBuilder();
        int c = reader.read();
        while (c > -1) {
          secret.append((char) c);
          c = reader.read();
        }

        String secretString = secret.toString();
        if (secretString.isEmpty()) {
          throw new RuntimeException(
              "No secret in HttpFs signature secret file: "
                  + signatureSecretFile);
        }

        props.setProperty(AuthenticationFilter.SIGNATURE_SECRET,
            secretString);
      } catch (IOException ex) {
        throw new RuntimeException("Could not read HttpFS signature "
            + "secret file: " + signatureSecretFile);
      }
    }
    setAuthHandlerClass(props);
    String dtkind = WebHdfsConstants.WEBHDFS_TOKEN_KIND.toString();
    if (conf.getBoolean(HttpFSServerWebServer.SSL_ENABLED_KEY, false)) {
      dtkind = WebHdfsConstants.SWEBHDFS_TOKEN_KIND.toString();
    }
    props.setProperty(KerberosDelegationTokenAuthenticationHandler.TOKEN_KIND,
                      dtkind);

View on GitHub (pinned to 2add963021)

Solutions

1. Write a random secret into the file: openssl rand -base64 32 > /etc/hadoop/security/httpfs-signature-secret, keep it on one line without trailing newline issues (any non-empty content works).
2. Set ownership to the httpfs user and mode 400, then restart HttpFS.
3. If secrets are centrally managed, re-run the secret-distribution step and verify file size > 0 before restart.

Example fix

# before
$ touch /etc/hadoop/security/httpfs-signature-secret   # empty -> startup failure

# after
$ openssl rand -base64 32 > /etc/hadoop/security/httpfs-signature-secret
$ chown httpfs:hadoop /etc/hadoop/security/httpfs-signature-secret
$ chmod 400 /etc/hadoop/security/httpfs-signature-secret

# verify secret file is non-empty before starting httpfs
SECRET=$(grep -A1 'httpfs.authentication.signature.secret.file' httpfs-site.xml | grep value | cut -d'>' -f2 | cut -d'<' -f1)
[ -s "$SECRET" ] || { echo "FATAL: secret file $SECRET empty"; exit 1; }

When it happens

Trigger: Creating the secret file with 'touch' or '> file' (zero bytes); a provisioning script that writes the path but redirects incorrectly; trailing truncation of the file by a config-management run; all-zero-length content after a failed secret-generation step.

Common situations: Automated deployments that create the file before generating the secret; secrets managed by Vault/KMS where the sync step failed silently; manual setup following the HttpFS security docs out of order.

Related errors

• Undefined property: signature.secret.file
• Could not read HttpFS signature secret file: {0}
• H09
• No COS Credential Providers
• No COS Credentials provided by %s

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/26e0a189c95238c5. Report an issue: GitHub.