apache/hadoop · error · IllegalArgumentException

NULL or empty string to sign

Error message

NULL or empty string to sign

What it means

Signer.sign() appends an HMAC-SHA256 signature to a string (typically the authentication token destined for a cookie). An empty signature input is meaningless and hides bugs, so null or zero-length input throws IllegalArgumentException('NULL or empty string to sign') before any crypto runs.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/Signer.java:56

   * @param secretProvider The SignerSecretProvider to use
   */
  public Signer(SignerSecretProvider secretProvider) {
    if (secretProvider == null) {
      throw new IllegalArgumentException("secretProvider cannot be NULL");
    }
    this.secretProvider = secretProvider;
  }

  /**
   * Returns a signed string.
   *
   * @param str string to sign.
   *
   * @return the signed string.
   */
  public synchronized String sign(String str) {
    if (str == null || str.length() == 0) {
      throw new IllegalArgumentException("NULL or empty string to sign");
    }
    byte[] secret = secretProvider.getCurrentSecret();
    String signature = computeSignature(secret, str);
    return str + SIGNATURE + signature;
  }

  /**
   * Verifies a signed string and extracts the original string.
   *
   * @param signedStr the signed string to verify and extract.
   *
   * @return the extracted original string.
   *
   * @throws SignerException thrown if the given string is not a signed string or if the signature is invalid.
   */
  public String verifyAndExtract(String signedStr) throws SignerException {
    int index = signedStr.lastIndexOf(SIGNATURE);
    if (index == -1) {

View on GitHub (pinned to 2add963021)

Solutions

1. Populate the AuthToken/AuthenticationToken (user, principal, type, expiry) before signing its string form
2. Add a guard at the call site for null/empty and treat it as a programming error
3. Review the code path that produced the empty string (usually an upstream setter was skipped)

Example fix

// before
cookie.setValue(signer.sign(token.toString())); // token.toString() may be empty

// after
String raw = token.toString();
if (raw == null || raw.isEmpty()) {
  throw new IllegalStateException("token serialized to empty string");
}
cookie.setValue(signer.sign(raw));

if (str == null || str.isEmpty()) throw new IllegalArgumentException("nothing to sign: check upstream token construction");

fail fast is intended — catch only to convert into a clearer application-specific error at the filter boundary

When it happens

Trigger: Calling signer.sign(str) where str is null or '' — e.g. building an authentication cookie before the token's toString() produced content, or passing an unset principal.

Common situations: Filter code signing a token whose fields were never populated; refactors that reorder token construction and signing; NPE-avoidance 'null passed through' chains ending at sign().

Related errors

• Malformed Kerberos name: ${name}
• secretProvider cannot be NULL
• Invalid signed text: {}
• Invalid signature
• Path must be absolute: " + path

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/1ac663ecc5426363. Report an issue: GitHub.