{"record":{"id":"0f373bc34ffa5de7","repo":"apache/hadoop","slug":"no-secret-in-signature-secret-file-signaturesec","errorCode":null,"errorMessage":"No secret in signature secret file: ${signatureSecretFile}","messagePattern":"No secret in signature secret file: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/FileSignerSecretProvider.java","lineNumber":58,"sourceCode":"  public void init(Properties config, ServletContext servletContext,\n                   long tokenValidity) throws Exception {\n\n    String signatureSecretFile = config.getProperty(\n        AuthenticationFilter.SIGNATURE_SECRET_FILE, null);\n\n    if (signatureSecretFile != null) {\n      try (Reader reader = new InputStreamReader(Files.newInputStream(\n              Paths.get(signatureSecretFile)), StandardCharsets.UTF_8)) {\n        StringBuilder sb = new StringBuilder();\n        int c = reader.read();\n        while (c > -1) {\n          sb.append((char) c);\n          c = reader.read();\n        }\n\n        secret = sb.toString().getBytes(StandardCharsets.UTF_8);\n        if (secret.length == 0) {\n          throw new RuntimeException(\"No secret in signature secret file: \"\n             + signatureSecretFile);\n        }\n      } catch (IOException ex) {\n        throw new RuntimeException(\"Could not read signature secret file: \" +\n            signatureSecretFile);\n      }\n    }\n\n    secrets = new byte[][]{secret};\n  }\n\n  @Override\n  public byte[] getCurrentSecret() {\n    return secret;\n  }\n\n  @Override\n  public byte[][] getAllSecrets() {","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/FileSignerSecretProvider.java#L40-L76","documentation":"FileSignerSecretProvider reads the whole content of the file configured via signature.secret.file and uses it verbatim as the HMAC secret for signing authentication cookies. If the file exists but is empty (zero bytes), provider initialization fails with this RuntimeException, which aborts servlet/filter startup.","triggerScenarios":"Initializing FileSignerSecretProvider (via the AuthenticationFilter 'signer.secret.provider' = 'file' configuration) where signature.secret.file points to a zero-length file.","commonSituations":"A placeholder secret file created empty by an automation playbook awaiting manual fill; a file truncated during deployment; someone editing the secret to empty while rotating keys.","solutions":["Write a non-empty random secret into the file, e.g. 'head -c 64 /dev/urandom | base64 > /etc/hadoop/auth-secret', and restart the service","Confirm the path in signature.secret.file is the file you actually edited","Add a deployment check that fails when the secret file is empty"],"exampleFix":"# before\ntouch /etc/hadoop/auth-secret   # empty file -> RuntimeException\n\n# after\nhead -c 64 /dev/urandom | base64 > /etc/hadoop/auth-secret\nchown hadoop:hadoop /etc/hadoop/auth-secret && chmod 600 /etc/hadoop/auth-secret","handlingStrategy":"validation","validationCode":"// pre-start check\njava.nio.file.Path p = java.nio.file.Paths.get(secretFile);\nif (!java.nio.file.Files.exists(p) || java.nio.file.Files.size(p) == 0) {\n  throw new IllegalStateException(\"signature.secret.file missing or empty: \" + secretFile);\n}","typeGuard":null,"tryCatchPattern":"try { provider.init(props, context, tokenValidity); } catch (RuntimeException e) { /* config/init error — fix deployment, do not retry */ }","preventionTips":["Generate secrets with 'head -c 64 /dev/urandom | base64' and verify non-empty before deploy","Alert on zero-length secret files in config management","Document which node/role owns writing the secret file"],"tags":["hadoop-auth","secret-provider","configuration","startup"],"backgroundTag":"empty-secret-file","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}