apache/hadoop · error · IllegalArgumentException

token cannot be NULL

Error message

token cannot be NULL

What it means

The third precondition of AuthenticatedURL.openConnection: the Token argument must be non-null. The token is both input (carries an existing authenticated cookie, if any) and output (receives the cookie the authenticator obtains); a null token makes that handshake impossible, so the method rejects it before contacting the server. Callers normally pass a Token created with the no-arg constructor.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java:351

   * Returns an authenticated {@link HttpURLConnection}.
   *
   * @param url the URL to connect to. Only HTTP/S URLs are supported.
   * @param token the authentication token being used for the user.
   *
   * @return an authenticated {@link HttpURLConnection}.
   *
   * @throws IOException if an IO error occurred.
   * @throws AuthenticationException if an authentication exception occurred.
   */
  public HttpURLConnection openConnection(URL url, Token token) throws IOException, AuthenticationException {
    if (url == null) {
      throw new IllegalArgumentException("url cannot be NULL");
    }
    if (!url.getProtocol().equalsIgnoreCase("http") && !url.getProtocol().equalsIgnoreCase("https")) {
      throw new IllegalArgumentException("url must be for a HTTP or HTTPS resource");
    }
    if (token == null) {
      throw new IllegalArgumentException("token cannot be NULL");
    }
    authenticator.authenticate(url, token);

    // allow the token to create the connection with a cookie handler for
    // managing session cookies.
    return token.openConnection(url, connConfigurator);
  }

  /**
   * Helper method that injects an authentication token to send with a
   * connection. Callers should prefer using
   * {@link Token#openConnection(URL, ConnectionConfigurator)} which
   * automatically manages authentication tokens.
   *
   * @param conn connection to inject the authentication token into.
   * @param token authentication token to inject.
   */
  public static void injectToken(HttpURLConnection conn, Token token) {

View on GitHub (pinned to 2add963021)

Solutions

1. Always create the holder: AuthenticatedURL.Token token = new AuthenticatedURL.Token(); then pass it to openConnection — it will be populated during authentication.
2. Reuse one Token across sequential requests to keep the session cookie (authenticated connections reuse it).
3. If a helper accepts an optional token, substitute new Token() for null inside the helper.
4. Check for null tokens from upstream factories (e.g. credentials cache) before calling.

Example fix

// before
new AuthenticatedURL().openConnection(url, null);

// after
AuthenticatedURL.Token token = new AuthenticatedURL.Token();
HttpURLConnection conn = new AuthenticatedURL().openConnection(url, token);

Objects.requireNonNull(token, "Token must be created (new AuthenticatedURL.Token()) before openConnection");
new AuthenticatedURL().openConnection(url, token);

When it happens

Trigger: Passing a null Token because the field was never initialized, a helper method with an optional token parameter defaulting to null, or code that skips token creation when it 'just wants a connection' without authentication state.

Common situations: Refactoring shared HTTP client utilities where the token was made optional; copy-pasted examples that omit the Token line; test code constructing AuthenticatedURL but forgetting the token argument ordering.

Related errors

• tokenStr cannot be null
• url cannot be NULL
• url must be for a HTTP or HTTPS resource
• Authentication failed, URL: {}, status: {}, message: {}
• Invalid SPNEGO sequence, 'WWW-Authenticate' header incorrect

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/528506303d1ddf2c. Report an issue: GitHub.