{"record":{"id":"7a8f9b8c8d852f76","repo":"apache/hadoop","slug":"encryptioncontext-not-present-in-getpathstatus-res-7a8f9b","errorCode":null,"errorMessage":"EncryptionContext not present in GetPathStatus response headers","messagePattern":"EncryptionContext not present in GetPathStatus response headers","errorType":"exception","errorClass":"PathIOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java","lineNumber":997,"sourceCode":"      /*\n       *  If file created with ENCRYPTION_CONTEXT, irrespective of whether isRestrictGpsOnOpenFile config is enabled or not,\n       *  GetPathStatus API has to be called to get the encryptionContext from the response header\n       */\n      else if (getClient().getEncryptionType() == EncryptionType.ENCRYPTION_CONTEXT\n              || !getAbfsConfiguration().shouldRestrictGpsOnOpenFile()) {\n\n        AbfsHttpOperation op = getClient().getPathStatus(relativePath, false,\n                tracingContext, null).getResult();\n        /*\n         * For file created with ENCRYPTION_CONTEXT, client shall receive\n         * encryptionContext from header field: X_MS_ENCRYPTION_CONTEXT.\n         */\n        if (getClient().getEncryptionType() == EncryptionType.ENCRYPTION_CONTEXT) {\n          final String fileEncryptionContext = op.getResponseHeader(\n             HttpHeaderConfigurations.X_MS_ENCRYPTION_CONTEXT);\n          if (fileEncryptionContext == null) {\n            LOG.debug(\"EncryptionContext missing in GetPathStatus response\");\n            throw new PathIOException(path.toString(),\n                \"EncryptionContext not present in GetPathStatus response headers\");\n          }\n          contextEncryptionAdapter = new ContextProviderEncryptionAdapter(\n              getClient().getEncryptionContextProvider(), getRelativePath(path),\n              fileEncryptionContext.getBytes(StandardCharsets.UTF_8));\n        }\n        resourceType = getClient().checkIsDir(op) ? DIRECTORY : FILE;\n        contentLength = extractContentLength(op);\n        eTag = op.getResponseHeader(HttpHeaderConfigurations.ETAG);\n      }\n      /* The only remaining case is:\n       * - restrictGpsOnOpenFile config is enabled with null/wrong FileStatus and encryptionType not as ENCRYPTION_CONTEXT\n       * In this case, we don't need to call GetPathStatus API.\n       */\n      else {\n        // do nothing\n      }\n","sourceCodeStart":979,"sourceCodeEnd":1015,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-azure/src/main/java/org/apache/hadoop/fs/azurebfs/AzureBlobFileSystemStore.java#L979-L1015","documentation":"Same root cause as the other EncryptionContext errors, raised on the open-for-read path. When EncryptionType.ENCRYPTION_CONTEXT is active and the caller did not supply a VersionedFileStatus already carrying the encryption context, openFileForRead issues GetPathStatus and requires the x-ms-encryption-context response header. A null header throws PathIOException, so FS.open()/openFile() fails before any data is read.","triggerScenarios":"fs.open(path) or fs.openFile(path) with the encryption-context provider configured, where the target file lacks x-ms-encryption-context - typically files written before encryption was enabled or uploaded by non-Hadoop tools. Also triggered when callers pass a non-VersionedFileStatus or a VersionedFileStatus whose getEncryptionContext() is null (the code then falls into the GetPathStatus branch).","commonSituations":"Enabling encryption context on existing data lakes; jobs re-reading old output after a security retrofit; interop with files landed by AzCopy/Databricks/SDK uploads.","solutions":["Rewrite or copy the affected files through the ABFS filesystem with fs.azure.encryption.context.provider.type configured so the context header is persisted.","Check the file's headers directly (REST GetPathStatus) to confirm x-ms-encryption-context is absent vs. the provider being wrong.","Serve pre-encryption legacy data from a mount without the encryption-context provider.","If passing a FileStatus hint to openFile, pass a VersionedFileStatus obtained from getFileStatus under the same encrypted mount so the context travels with it."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  in = fs.openFile(path).build().open();\n} catch (PathIOException e) {\n  if (e.getMessage().contains(\"GetPathStatus response headers\")) {\n    // missing x-ms-encryption-context: file must be rewritten under the encrypted mount\n  }\n}","preventionTips":["Verify files carry x-ms-encryption-context (raw GetPathStatus) before pointing encrypted readers at old data.","Pass a VersionedFileStatus from the same encrypted mount when using openFile hints.","Plan migrations: encrypt-then-cutover, never the reverse."],"tags":["azure","abfs","encryption","client-side-encryption","file-read","http-header"],"backgroundTag":"encryption-context-missing","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}