{"record":{"id":"95845b9ffd4a605e","repo":"apache/hadoop","slug":"invalid-authenticationtoken-type","errorCode":null,"errorMessage":"Invalid AuthenticationToken type","messagePattern":"Invalid AuthenticationToken type","errorType":"exception","errorClass":"AuthenticationException","httpStatus":401,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java","lineNumber":451,"sourceCode":"        if (cookie.getName().equals(AuthenticatedURL.AUTH_COOKIE)) {\n          tokenStr = cookie.getValue();\n          if (tokenStr.isEmpty()) {\n            throw new AuthenticationException(\"Unauthorized access\");\n          }\n          try {\n            tokenStr = signer.verifyAndExtract(tokenStr);\n          } catch (SignerException ex) {\n            throw new AuthenticationException(ex);\n          }\n          break;\n        }\n      }\n    }\n    if (tokenStr != null) {\n      token = AuthenticationToken.parse(tokenStr);\n      boolean match = verifyTokenType(getAuthenticationHandler(), token);\n      if (!match) {\n        throw new AuthenticationException(\"Invalid AuthenticationToken type\");\n      }\n      if (token.isExpired()) {\n        throw new AuthenticationException(\"AuthenticationToken expired\");\n      }\n    }\n    return token;\n  }\n\n  /**\n   * This method verifies if the specified token type matches one of the the\n   * token types supported by a specified {@link AuthenticationHandler}. This\n   * method is specifically designed to work with\n   * {@link CompositeAuthenticationHandler} implementation which supports\n   * multiple authentication schemes while the {@link AuthenticationHandler}\n   * interface supports a single type via\n   * {@linkplain AuthenticationHandler#getType()} method.\n   *\n   * @param handler The authentication handler whose supported token types","sourceCodeStart":433,"sourceCodeEnd":469,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java#L433-L469","documentation":"After parsing a valid, correctly signed hadoop.auth cookie, AuthenticationFilter.getToken calls verifyTokenType to check that the token's type matches one of the types the configured AuthenticationHandler supports (matters for CompositeAuthenticationHandler, which accepts several; and for anonymous/pseudo 'a' tokens). A mismatch throws AuthenticationException('Invalid AuthenticationToken type'): the signature is fine, but the cookie was issued under a different authentication scheme than the one now active.","triggerScenarios":"Server switched authentication.type (e.g. kerberos -> simple, or handler set changed) while the signing secret stayed the same, so old cookies still verify but their type (e.g. 'kerberos' or anonymous 'a') is no longer accepted; composite handler whose type list does not include the token's type; a pseudo-issued token presented to a kerberos-only handler.","commonSituations":"Rolling back or changing auth configuration on a cluster without rotating the signing secret; staging and production sharing a secret file; composite handlers (e.g. kerberos+token) configured inconsistently across nodes; long-lived browser cookies surviving an auth-type migration.","solutions":["Have clients re-authenticate (clear the hadoop.auth cookie or open a fresh session) to obtain a token of the new type.","When changing authentication.type, rotate the signing secret (signature.secret.file / random) so stale cookies are rejected as invalid signatures rather than type-mismatched.","For CompositeAuthenticationHandler, confirm the token types it advertises include every scheme clients actually use.","Verify all server nodes share the same handler configuration so type checks agree across the fleet."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// server-side tooling: ensure handler advertises the token type you issue\nAuthenticationHandler h = getAuthenticationHandler();\nSet<String> accepted = new HashSet<>(Collections.singletonList(h.getType()));\n// for composite handlers, add AuthenticationHandlerUtil.getAuthenticationHandlerTypes(h)\nif (!accepted.contains(expectedTokenType)) { failConfig(\"handler cannot accept token type \" + expectedTokenType); }","typeGuard":null,"tryCatchPattern":"try {\n  new AuthenticatedURL().openConnection(url, token);\n} catch (AuthenticationException e) {\n  if (\"Invalid AuthenticationToken type\".equals(e.getMessage())) {\n    token = new AuthenticatedURL.Token(); // old-scheme cookie: re-authenticate under current type\n    authenticator.authenticate(url, token);\n  } else { throw e; }\n}","preventionTips":["Rotate the signing secret whenever authentication.type changes.","Keep composite-handler type lists consistent across all server nodes.","After auth migrations, expect clients to need one clean re-authentication."],"tags":["authentication","token-type","hadoop-auth","auth-cookie","composite-handler"],"backgroundTag":"token-type-mismatch","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}