apache/hadoop · error · ServletException

The element of the whitelist: ${s} must start with '/' and m

Error message

The element of the whitelist: ${s} must start with '/' and must not contain special characters afterwards

What it means

Error "The element of the whitelist: ${s} must start with '/' and must not contain special characters afterwards" thrown in apache/hadoop.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/KerberosAuthenticationHandler.java:196

      }
      String nameRules = config.getProperty(NAME_RULES, null);
      if (nameRules != null) {
        KerberosName.setRules(nameRules);
      }
      String ruleMechanism = config.getProperty(RULE_MECHANISM, null);
      if (ruleMechanism != null) {
        KerberosName.setRuleMechanism(ruleMechanism);
      }

      final String whitelistStr = config.getProperty(ENDPOINT_WHITELIST, null);
      if (whitelistStr != null) {
        final String[] strs = whitelistStr.trim().split("\\s*[,\n]\\s*");
        for (String s: strs) {
          if (s.isEmpty()) continue;
          if (ENDPOINT_PATTERN.matcher(s).matches()) {
            whitelist.add(s);
          } else {
            throw new ServletException(
                "The element of the whitelist: " + s + " must start with '/'"
                    + " and must not contain special characters afterwards");
          }
        }
      }

      try {
        gssManager = Subject.doAs(serverSubject,
            new PrivilegedExceptionAction<GSSManager>() {
              @Override
              public GSSManager run() throws Exception {
                return GSSManager.getInstance();
              }
            });
      } catch (PrivilegedActionException ex) {
        throw ex.getException();
      }
    } catch (Exception ex) {

View on GitHub (pinned to 2add963021)

Solutions

1. Fix the whitelist entry so it starts with '/' and contains no special characters after the leading slash.

Example fix

Use /status instead of status?* in the whitelist.

When it happens

Trigger: Raised at runtime when the documented precondition or configuration requirement for this operation is violated.

Common situations: Misconfigured or missing property, invalid user input, or calling the API before its prerequisites are met.

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/29f16da6601016c1. Report an issue: GitHub.