apache/hadoop · error · AuthenticationException

Unauthorized access

Error message

Unauthorized access

What it means

AuthenticationFilter.getToken extracts the hadoop.auth cookie from the request; if the cookie exists but its value is the empty string, it throws AuthenticationException('Unauthorized access') before signature verification — an empty cookie is treated as an explicit 'no credentials'. The client is then expected to authenticate (which sends it through the handler and issues a fresh signed cookie).

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java:436

   * to perform user authentication.
   *
   * @param request request object.
   *
   * @return the Authentication token if the request is authenticated, <code>null</code> otherwise.
   *
   * @throws IOException thrown if an IO error occurred.
   * @throws AuthenticationException thrown if the token is invalid or if it has expired.
   */
  protected AuthenticationToken getToken(HttpServletRequest request) throws IOException, AuthenticationException {
    AuthenticationToken token = null;
    String tokenStr = null;
    Cookie[] cookies = request.getCookies();
    if (cookies != null) {
      for (Cookie cookie : cookies) {
        if (cookie.getName().equals(AuthenticatedURL.AUTH_COOKIE)) {
          tokenStr = cookie.getValue();
          if (tokenStr.isEmpty()) {
            throw new AuthenticationException("Unauthorized access");
          }
          try {
            tokenStr = signer.verifyAndExtract(tokenStr);
          } catch (SignerException ex) {
            throw new AuthenticationException(ex);
          }
          break;
        }
      }
    }
    if (tokenStr != null) {
      token = AuthenticationToken.parse(tokenStr);
      boolean match = verifyTokenType(getAuthenticationHandler(), token);
      if (!match) {
        throw new AuthenticationException("Invalid AuthenticationToken type");
      }
      if (token.isExpired()) {
        throw new AuthenticationException("AuthenticationToken expired");

View on GitHub (pinned to 2add963021)

Solutions

1. Client side: clear the hadoop.auth cookie entirely (or use a fresh/incognito session) and access the URL again to trigger a new authentication.
2. Server/app side: on logout, expire the cookie properly (Max-Age=0) instead of setting an empty value.
3. Give each web app its own cookie domain/path scope so the same cookie name cannot be blanked by a sibling app.
4. If a proxy rewrites cookies, disable cookie modification for the hadoop.auth name or bypass the proxy for the UI.

// client side: only send a non-empty cookie
String cookie = cookieStore.get("hadoop.auth");
if (cookie == null || cookie.isEmpty()) {
  cookieStore.remove("hadoop.auth"); // force clean re-authentication
}

try {
  new AuthenticatedURL().openConnection(url, token);
} catch (AuthenticationException e) {
  if ("Unauthorized access".equals(e.getMessage())) {
    token = new AuthenticatedURL.Token(); // drop blank/invalid cookie and re-auth
    new AuthenticatedURL().openConnection(url, token);
  } else { throw e; }
}

When it happens

Trigger: A browser or client sends 'hadoop.auth=' (empty value): previous logout cleared the value but left the cookie; cookie rewritten/blanked by a proxy or client cookie jar bug; multiple web apps on the same host overwriting the cookie name; manually constructed Cookie headers with no value.

Common situations: After logout flows that expire the cookie by blanking it; cookie-name collision when several Hadoop web UIs share a host and path scope; clients copying Cookie headers between requests and dropping the value; intermediary caches/CDNs mangling Set-Cookie.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication failed, URL: {}, status: {}, message: {}
• Invalid token string, missing attributes
• tokenStr cannot be null
• url cannot be NULL
• url must be for a HTTP or HTTPS resource

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/ab055a7e77627e97. Report an issue: GitHub.