{"record":{"id":"2665f4320973449d","repo":"apache/seatunnel","slug":"collector-authentication-failed-from","errorCode":null,"errorMessage":"Collector authentication failed from {}","messagePattern":"Collector authentication failed from (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"seatunnel-connectors-v2/connector-edge-socket/src/main/java/org/apache/seatunnel/connectors/seatunnel/edgesocket/protocol/IngressProtocolHandler.java","lineNumber":74,"sourceCode":"            authLine = channel.readLine();\n        } catch (SocketTimeoutException timeoutException) {\n            channel.writeLine(EdgeSocketResponseCode.AUTH_FAILED.getCode());\n            log.warn(\n                    \"Collector authentication timeout from {}, connection rejected\",\n                    channel.remoteAddress());\n            return false;\n        }\n        if (authLine == null) {\n            channel.writeLine(EdgeSocketResponseCode.AUTH_FAILED.getCode());\n            log.warn(\n                    \"Collector from {} closed connection before authentication\",\n                    channel.remoteAddress());\n            return false;\n        }\n        String presentedToken = parseAuthToken(authLine);\n        if (!constantTimeEquals(config.getToken(), presentedToken)) {\n            channel.writeLine(EdgeSocketResponseCode.AUTH_FAILED.getCode());\n            log.warn(\"Collector authentication failed from {}\", channel.remoteAddress());\n            return false;\n        }\n        channel.writeLine(EdgeSocketResponseCode.ACK.getCode());\n        return true;\n    }\n\n    public void receiveLoop(IngressChannel channel, BooleanSupplier isActive) throws IOException {\n        while (isActive.getAsBoolean()) {\n            String record;\n            try {\n                record = channel.readLine();\n            } catch (SocketTimeoutException timeoutException) {\n                continue;\n            }\n            if (record == null) {\n                return;\n            }\n            channel.writeLine(dispatch(record));","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-edge-socket/src/main/java/org/apache/seatunnel/connectors/seatunnel/edgesocket/protocol/IngressProtocolHandler.java#L56-L92","documentation":"This warning is logged by the edge-socket ingress protocol handler when a collector presents an authentication token that does not match the configured token. The handler compares the presented token against config.getToken() using a constant-time comparison to avoid timing attacks, and on mismatch writes the AUTH_FAILED response code and refuses authentication. It is a deliberate, expected rejection path for unauthenticated clients, not an internal fault.","triggerScenarios":"A collector socket connects, sends an auth line, and the parsed token from the auth line differs from the token configured on the edge-socket source; parseAuthToken returned something that failed constantTimeEquals against the configured token.","commonSituations":"Collector and server configured with different tokens (stale token in collector config after rotation), token with trailing whitespace/newline or wrong prefix on the collector side, collector pointing at the wrong environment (staging token vs prod server).","solutions":["Set the same token in the collector's auth line and in the edge-socket source config (token option).","Inspect the collector's auth line format so parseAuthToken extracts the full token (check prefix, separators, and no trailing newline/CR).","If tokens were rotated, redeploy collector config with the current server token.","Enable debug logging on both sides to confirm the server received the auth line at all."],"exampleFix":"// before (collector)\nAUTH token=stale-rotated-token\n// after (collector config)\nedge.socket.token = current-server-token  # matches source config","handlingStrategy":"validation","validationCode":"if (!Objects.equals(configuredToken, collectorToken) || configuredToken == null || configuredToken.isEmpty()) { throw new IllegalStateException(\"collector token does not match edge-socket source token\"); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep collector and server tokens in the same secret/config source so they rotate together","Strip whitespace when reading tokens from config files","Test auth once at startup with a probe connection before real traffic","Never log the token itself, only the remote address"],"tags":["security","authentication","tcp","config"],"backgroundTag":"authentication-required","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}