{"record":{"id":"9c6be08da95dcd32","repo":"apache/hadoop","slug":"authentication-failed-url-status-messag","errorCode":null,"errorMessage":"Authentication failed, URL: {}, status: {}, message: {}","messagePattern":"Authentication failed, URL: (.+?), status: (.+?), message: (.+?)","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java","lineNumber":403,"sourceCode":"   * @throws AuthenticationException if an authentication exception occurred.\n   */\n  public static void extractToken(HttpURLConnection conn, Token token) throws IOException, AuthenticationException {\n    int respCode = conn.getResponseCode();\n    if (respCode == HttpURLConnection.HTTP_OK\n        || respCode == HttpURLConnection.HTTP_CREATED\n        || respCode == HttpURLConnection.HTTP_ACCEPTED) {\n      // cookie handler should have already extracted the token.  try again\n      // for backwards compatibility if this method is called on a connection\n      // not opened via this instance.\n      token.cookieHandler.put(null, conn.getHeaderFields());\n    } else if (respCode == HttpURLConnection.HTTP_NOT_FOUND) {\n      LOG.trace(\"Setting token value to null ({}), resp={}\", token, respCode);\n      token.set(null);\n      throw new FileNotFoundException(conn.getURL().toString());\n    } else {\n      LOG.trace(\"Setting token value to null ({}), resp={}\", token, respCode);\n      token.set(null);\n      throw new AuthenticationException(\"Authentication failed\" +\n          \", URL: \" + conn.getURL() +\n          \", status: \" + conn.getResponseCode() +\n          \", message: \" + conn.getResponseMessage());\n    }\n  }\n\n}\n","sourceCodeStart":385,"sourceCodeEnd":411,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java#L385-L411","documentation":"This AuthenticationException is thrown while checking an authenticated connection's response: for any status that is not a success (OK/CREATED/ACCEPTED) or 404, the token is cleared and the exception embeds the URL, HTTP status, and server message. Practically it means the server refused the authenticated request — the exact status is in the text. It is thrown by the AuthenticatedURL helpers that validate/extract the token from a live response (the extractToken-style path, including its backwards-compatible invocation on connections not opened through this instance).","triggerScenarios":"Calling the token-extraction/validation helper on a connection whose response code is 401/403/5xx: token rejected after expiry or signing-secret rotation (401), user not authorized (403), or backend errors (500/503) while the authentication filter is in front. Also using a Token whose cookie was invalidated server-side.","commonSituations":"Long-running clients holding a hadoop.auth cookie past validity; servers rotating the signing secret (restart with new secret invalidates all cookies); proxy/load balancer returning 502/503 that surfaces as this message; access attempts to a protected resource by an unauthorized user.","solutions":["Parse the status from the message: 401 -> discard the token and re-authenticate via Authenticator.authenticate(); 403 -> fix authorization (proxyuser ACLs, permissions); 5xx -> check server-side logs and retry after recovery.","Discard and recreate the Token on this exception — the helper already set it null; do not reuse the old cookie.","Verify client and server clocks and hadoop.http.authentication.token.validity if 401s appear systematically.","If servers rotate signing secrets, coordinate client re-auth or increase validity; check the authentication filter secret file sync across instances."],"exampleFix":"// before\nHttpURLConnection conn = new AuthenticatedURL().openConnection(url, token);\n\n// after\ntry {\n  HttpURLConnection conn = new AuthenticatedURL().openConnection(url, token);\n} catch (AuthenticationException e) {\n  token = new AuthenticatedURL.Token(); // cookie already cleared\n  new KerberosAuthenticator().authenticate(url, token); // re-auth, then retry\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  HttpURLConnection conn = new AuthenticatedURL().openConnection(url, token);\n} catch (AuthenticationException e) {\n  String msg = e.getMessage();\n  if (msg.contains(\"status: 401\")) { reauthenticate(url, token); retry(); }\n  else if (msg.contains(\"status: 403\")) { throw new AccessDeniedException(url.toString()); }\n  else { throw e; }\n}","preventionTips":["Treat any auth failure as 'token dead': recreate the Token before retrying.","Re-authenticate proactively when tokens approach their validity window.","Keep server signing secrets in sync across instances to avoid mass 401s."],"tags":["authentication","http-status","hadoop-auth","auth-cookie","unauthorized"],"backgroundTag":"http-auth-failed","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}