{"record":{"id":"26e0a189c95238c5","repo":"apache/hadoop","slug":"no-secret-in-httpfs-signature-secret-file-0","errorCode":null,"errorMessage":"No secret in HttpFs signature secret file: {0}","messagePattern":"No secret in HttpFs signature secret file: (.+?)","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSAuthenticationFilter.java","lineNumber":97,"sourceCode":"    String signatureSecretFile = props.getProperty(SIGNATURE_SECRET_FILE, null);\n    if (signatureSecretFile == null) {\n      throw new RuntimeException(\"Undefined property: \"\n          + SIGNATURE_SECRET_FILE);\n    }\n\n    if (!isRandomSecret(filterConfig)) {\n      try (Reader reader = new InputStreamReader(Files.newInputStream(\n          Paths.get(signatureSecretFile)), StandardCharsets.UTF_8)) {\n        StringBuilder secret = new StringBuilder();\n        int c = reader.read();\n        while (c > -1) {\n          secret.append((char) c);\n          c = reader.read();\n        }\n\n        String secretString = secret.toString();\n        if (secretString.isEmpty()) {\n          throw new RuntimeException(\n              \"No secret in HttpFs signature secret file: \"\n                  + signatureSecretFile);\n        }\n\n        props.setProperty(AuthenticationFilter.SIGNATURE_SECRET,\n            secretString);\n      } catch (IOException ex) {\n        throw new RuntimeException(\"Could not read HttpFS signature \"\n            + \"secret file: \" + signatureSecretFile);\n      }\n    }\n    setAuthHandlerClass(props);\n    String dtkind = WebHdfsConstants.WEBHDFS_TOKEN_KIND.toString();\n    if (conf.getBoolean(HttpFSServerWebServer.SSL_ENABLED_KEY, false)) {\n      dtkind = WebHdfsConstants.SWEBHDFS_TOKEN_KIND.toString();\n    }\n    props.setProperty(KerberosDelegationTokenAuthenticationHandler.TOKEN_KIND,\n                      dtkind);","sourceCodeStart":79,"sourceCodeEnd":115,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/HttpFSAuthenticationFilter.java#L79-L115","documentation":"HttpFSAuthenticationFilter reads the file named by httpfs.authentication.signature.secret.file and uses its full contents as the cookie-signing secret for hadoop-auth. If the file is readable but empty, filter init throws RuntimeException('No secret in HttpFs signature secret file: <path>') and the webapp fails to start.","triggerScenarios":"Creating the secret file with 'touch' or '> file' (zero bytes); a provisioning script that writes the path but redirects incorrectly; trailing truncation of the file by a config-management run; all-zero-length content after a failed secret-generation step.","commonSituations":"Automated deployments that create the file before generating the secret; secrets managed by Vault/KMS where the sync step failed silently; manual setup following the HttpFS security docs out of order.","solutions":["Write a random secret into the file: openssl rand -base64 32 > /etc/hadoop/security/httpfs-signature-secret, keep it on one line without trailing newline issues (any non-empty content works).","Set ownership to the httpfs user and mode 400, then restart HttpFS.","If secrets are centrally managed, re-run the secret-distribution step and verify file size > 0 before restart."],"exampleFix":"# before\n$ touch /etc/hadoop/security/httpfs-signature-secret   # empty -> startup failure\n\n# after\n$ openssl rand -base64 32 > /etc/hadoop/security/httpfs-signature-secret\n$ chown httpfs:hadoop /etc/hadoop/security/httpfs-signature-secret\n$ chmod 400 /etc/hadoop/security/httpfs-signature-secret","handlingStrategy":"validation","validationCode":"# verify secret file is non-empty before starting httpfs\nSECRET=$(grep -A1 'httpfs.authentication.signature.secret.file' httpfs-site.xml | grep value | cut -d'>' -f2 | cut -d'<' -f1)\n[ -s \"$SECRET\" ] || { echo \"FATAL: secret file $SECRET empty\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate secrets with openssl rand -base64 32 > file in one step; never touch-then-fill.","Alert on zero-byte secret files in config management (file size check).","After any secret rotation, run a pre-start validation and restart HttpFS deliberately."],"tags":["httpfs","hadoop-auth","authentication","signature-secret","configuration","startup-failure"],"backgroundTag":"empty-secret-file","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}