apache/hadoop · error · IllegalArgumentException

Unexpected value in xFrameOption.

Error message

Unexpected value in xFrameOption.

What it means

HttpServer2.XFrameOption.getEnum() does a case-sensitive exact string match against the three allowed values 'DENY', 'SAMEORIGIN', and 'ALLOW-FROM' (the enum constant is ALLOWFROM, but toString() returns 'ALLOW-FROM', so even 'ALLOWFROM' without the dash is rejected). An invalid value throws IllegalArgumentException at builder time, failing daemon startup. The value comes from each service's xframe config, e.g. dfs.namenode.http.xframe.value for NameNode/Secondary/JournalNode, or Builder.setXFrameOption directly.

Source

Thrown at hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java:2015

      return this.name;
    }

    /**
     * We cannot use valueOf since the AllowFrom enum differs from its value
     * Allow-From. This is a helper method that does exactly what valueof does,
     * but allows us to handle the AllowFrom issue gracefully.
     *
     * @param value - String must be DENY, SAMEORIGIN or ALLOW-FROM.
     * @return XFrameOption or throws IllegalException.
     */
    private static XFrameOption getEnum(String value) {
      Preconditions.checkState(value != null && !value.isEmpty());
      for (XFrameOption xoption : values()) {
        if (value.equals(xoption.toString())) {
          return xoption;
        }
      }
      throw new IllegalArgumentException("Unexpected value in xFrameOption.");
    }
  }


  private Map<String, String> setHeaders(Configuration conf) {
    Map<String, String> xFrameParams = new HashMap<>();
    Map<String, String> headerConfigMap =
            conf.getValByRegex(HTTP_HEADER_REGEX);

    xFrameParams.putAll(getDefaultHeaders());
    if(this.xFrameOptionIsEnabled) {
      xFrameParams.put(HTTP_HEADER_PREFIX+X_FRAME_OPTIONS,
              this.xFrameOption.toString());
    }
    xFrameParams.putAll(headerConfigMap);
    return xFrameParams;
  }

View on GitHub (pinned to 2add963021)

Solutions

1. Set the property to exactly one of DENY, SAMEORIGIN, or ALLOW-FROM (uppercase, dash included)
2. If unsure, omit the value: services default to SAMEORIGIN
3. Check every node's config for the stray value, since the failing daemon names itself in the log

Example fix

<!-- hdfs-site.xml before -->
<property><name>dfs.namenode.http.xframe.value</name><value>sameorigin</value></property>

<!-- after -->
<property><name>dfs.namenode.http.xframe.value</name><value>SAMEORIGIN</value></property>

private static final Set<String> XFRAME_ALLOWED =
    Set.of("DENY", "SAMEORIGIN", "ALLOW-FROM");
String value = conf.getTrimmed("dfs.namenode.http.xframe.value", "SAMEORIGIN");
if (!XFRAME_ALLOWED.contains(value)) {
  throw new ConfigValidationException(
      "xframe value must be one of DENY, SAMEORIGIN, ALLOW-FROM (case-sensitive): " + value);
}

When it happens

Trigger: Setting dfs.namenode.http.xframe.value (or the YARN/webapp equivalent) to a lowercase or free-form value like 'sameorigin', 'allow-all', or 'ALLOWFROM'; passing such a string to HttpServer2.Builder.setXFrameOption in an embedded service.

Common situations: Hardening passes that add clickjacking protection with a copied config snippet from another product (which allows different tokens); operators assuming header values are case-insensitive.

Related errors

• Property %s not specified
• unknown scheme for endpoint:{}
• Problem starting http server
• No more entry in " + f
• f + " is a directory"

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/d428327d76389def. Report an issue: GitHub.