{"record":{"id":"9f89c8e0dd3c58dc","repo":"apache/druid","slug":"decompression-failed","errorCode":null,"errorMessage":"Decompression failed","messagePattern":"Decompression failed","errorType":"exception","errorClass":"RuntimeException","httpStatus":500,"severity":"error","filePath":"extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java","lineNumber":248,"sourceCode":"    try (ByteArrayOutputStream byteStream = new ByteArrayOutputStream(data.length)) {\n      try (GZIPOutputStream gzip = new GZIPOutputStream(byteStream)) {\n        gzip.write(data);\n      }\n      return byteStream.toByteArray();\n    }\n    catch (IOException ex) {\n      throw new RuntimeException(\"Compression failed\", ex);\n    }\n  }\n\n  private byte[] uncompress(final byte[] data)\n  {\n    try (ByteArrayInputStream inputStream = new ByteArrayInputStream(data);\n         GZIPInputStream gzip = new GZIPInputStream(inputStream)) {\n      return ByteStreams.toByteArray(gzip);\n    }\n    catch (IOException ex) {\n      throw new RuntimeException(\"Decompression failed\", ex);\n    }\n  }\n\n  /**\n   * Serialize object using standard Java serialization\n   */\n  private byte[] serializeToBytes(Serializable obj)\n  {\n    Preconditions.checkNotNull(obj, \"Object to serialize cannot be null\");\n\n    try (ByteArrayOutputStream baos = new ByteArrayOutputStream();\n         ObjectOutputStream oos = new ObjectOutputStream(baos)) {\n      oos.writeObject(obj);\n      oos.flush();\n      return baos.toByteArray();\n    }\n    catch (IOException e) {\n      throw new RuntimeException(\"Failed to serialize object\", e);","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java#L230-L266","documentation":"Pac4jSessionStore.uncompress wraps GZIP decompression of data read back from a cookie. An IOException from GZIPInputStream means the bytes are not valid GZIP data — typically corrupted, truncated, or produced by a different cipher/encoding step — so it rethrows as RuntimeException.","triggerScenarios":"Calling uncompressDecryptBase64 with cookie bytes that were truncated by the container (cookie size limits), tampered with, encrypted/decrypted with different keys across restarts, or otherwise not valid GZIP stream data.","commonSituations":"Changing the encryption key between deployments so decrypted bytes are garbage; cookies truncated over the ~4KB browser limit; manual cookie editing; session data written by a different Druid version.","solutions":["Verify the encryption key/secret is unchanged across deployments","Ensure session data fits within cookie size limits (compress first, check length)","Log and discard invalid session cookies, forcing re-authentication instead of failing the request","Wrap uncompressDecryptBase64 in try-catch and treat failure as 'no session'"],"exampleFix":"// before\nbyte[] data = store.uncompressDecryptBase64(cookieValue);\n// after\nbyte[] data;\ntry {\n  data = store.uncompressDecryptBase64(cookieValue);\n} catch (RuntimeException e) {\n  LOGGER.warn(e, \"Invalid session cookie; treating as unauthenticated\");\n  data = null;\n}","handlingStrategy":"try-catch","validationCode":"// Heuristic pre-check on cookie size before trusting it\nif (cookieValue == null || cookieValue.length() > 4096) { /* discard cookie, force re-auth */ }","typeGuard":null,"tryCatchPattern":"try { data = store.uncompressDecryptBase64(v); } catch (RuntimeException e) { LOGGER.warn(e, \"Invalid session cookie\"); clearCookie(); data = null; }","preventionTips":["Never change encryption keys without a cookie-invalidation plan","Cap serialized session size below cookie limits","Treat session restore failures as unauthenticated, not fatal"],"tags":["compression","gzip","corrupt-data","java-io"],"backgroundTag":"decompression-failed","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}