apache/hadoop · error · IllegalArgumentException

url cannot be NULL

Error message

url cannot be NULL

What it means

AuthenticatedURL.openConnection(URL, Token) insists on a non-null URL before doing anything else; null triggers IllegalArgumentException('url cannot be NULL'). The method drives the whole SPNEGO/cookie authentication handshake, so without a concrete endpoint there is nothing to authenticate against — hence the immediate reject rather than an NPE deeper in the authenticator.

Source

Thrown at hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java:345

   */
  protected Authenticator getAuthenticator() {
    return authenticator;
  }

  /**
   * Returns an authenticated {@link HttpURLConnection}.
   *
   * @param url the URL to connect to. Only HTTP/S URLs are supported.
   * @param token the authentication token being used for the user.
   *
   * @return an authenticated {@link HttpURLConnection}.
   *
   * @throws IOException if an IO error occurred.
   * @throws AuthenticationException if an authentication exception occurred.
   */
  public HttpURLConnection openConnection(URL url, Token token) throws IOException, AuthenticationException {
    if (url == null) {
      throw new IllegalArgumentException("url cannot be NULL");
    }
    if (!url.getProtocol().equalsIgnoreCase("http") && !url.getProtocol().equalsIgnoreCase("https")) {
      throw new IllegalArgumentException("url must be for a HTTP or HTTPS resource");
    }
    if (token == null) {
      throw new IllegalArgumentException("token cannot be NULL");
    }
    authenticator.authenticate(url, token);

    // allow the token to create the connection with a cookie handler for
    // managing session cookies.
    return token.openConnection(url, connConfigurator);
  }

  /**
   * Helper method that injects an authentication token to send with a
   * connection. Callers should prefer using
   * {@link Token#openConnection(URL, ConnectionConfigurator)} which

View on GitHub (pinned to 2add963021)

Solutions

1. Validate the URL at configuration-load time: Objects.requireNonNull(url, '...endpoint missing...') with a message naming the config key.
2. Fail fast at startup with a clear 'missing property X' error instead of deep inside the auth call.
3. Add unit coverage for the unconfigured path so it is a known, tested failure.
4. Where the URL comes from user input, parse and reject early with a helpful message.

Example fix

// before
URL url = getUrlFromConfig(conf); // may be null
conn = new AuthenticatedURL().openConnection(url, token);

// after
URL url = getUrlFromConfig(conf);
if (url == null) { throw new IllegalArgumentException('conf key ' + ENDPOINT_KEY + ' not set'); }
conn = new AuthenticatedURL().openConnection(url, token);

URL url = getEndpointUrl(conf);
Objects.requireNonNull(url, "service endpoint not configured (check " + ENDPOINT_KEY + ")");
new AuthenticatedURL().openConnection(url, token);

When it happens

Trigger: Passing a URL variable that failed to initialize: new URL on a malformed string threw earlier and was swallowed; configuration key for the web endpoint missing so getUrl() returned null; ternaries that yield null on the untested branch.

Common situations: Reading the service endpoint from config whose key is absent in the deployed core-site.xml; environment-specific code paths (prod sets the URL, test does not) reaching production; refactors replacing constants with config lookups without defaults.

Related errors

• tokenStr cannot be null
• token cannot be NULL
• url must be for a HTTP or HTTPS resource
• Authentication failed, URL: {}, status: {}, message: {}
• Invalid SPNEGO sequence, 'WWW-Authenticate' header incorrect

AI-assisted analysis of apache/hadoop@2add963021 (2026-08-22). Data as JSON: /api/errors/6bc885b7643b386f. Report an issue: GitHub.