{"record":{"id":"a64e105a8c792440","repo":"apache/hadoop","slug":"invalid-signed-text","errorCode":null,"errorMessage":"Invalid signed text: {}","messagePattern":"Invalid signed text: (.+?)","errorType":"exception","errorClass":"SignerException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/Signer.java","lineNumber":75,"sourceCode":"    }\n    byte[] secret = secretProvider.getCurrentSecret();\n    String signature = computeSignature(secret, str);\n    return str + SIGNATURE + signature;\n  }\n\n  /**\n   * Verifies a signed string and extracts the original string.\n   *\n   * @param signedStr the signed string to verify and extract.\n   *\n   * @return the extracted original string.\n   *\n   * @throws SignerException thrown if the given string is not a signed string or if the signature is invalid.\n   */\n  public String verifyAndExtract(String signedStr) throws SignerException {\n    int index = signedStr.lastIndexOf(SIGNATURE);\n    if (index == -1) {\n      throw new SignerException(\"Invalid signed text: \" + signedStr);\n    }\n    String originalSignature = signedStr.substring(index + SIGNATURE.length());\n    String rawValue = signedStr.substring(0, index);\n    checkSignatures(rawValue, originalSignature);\n    return rawValue;\n  }\n\n  /**\n   * Returns then signature of a string.\n   *\n   * @param secret The secret to use\n   * @param str string to sign.\n   *\n   * @return the signature for the string.\n   */\n  protected String computeSignature(byte[] secret, String str) {\n    try {\n      SecretKeySpec key = new SecretKeySpec((secret), SIGNING_ALGORITHM);","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/Signer.java#L57-L93","documentation":"Signer.verifyAndExtract() splits a signed string on the last occurrence of the '&s=' delimiter that separates the payload from its signature. If the delimiter is absent, the string was never produced by Signer.sign(), and SignerException('Invalid signed text: ...') is thrown, echoing the input.","triggerScenarios":"Calling verifyAndExtract() on a raw unsigned token (no '&s=<hmac>' suffix), a cookie that was truncated before the signature, or a value from a different/older signer format (e.g. pre-HmacSHA256 rollover artifacts).","commonSituations":"Clients sending self-made 'hadoop.auth' cookie values; proxies stripping query-like suffixes; stale cookies from a previous deployment surviving a secret change but losing structure; test fixtures with hand-written cookies.","solutions":["Only pass values that came from Signer.sign() — check for the '&s=' segment first","On this exception, discard the cookie and re-authenticate the client","If cookies keep arriving unsigned, audit for clients or tools writing their own hadoop.auth value"],"exampleFix":"// before\nString raw = signer.verifyAndExtract(cookie.getValue());\n\n// after: pre-check, then treat failure as re-authentication\nString value = cookie.getValue();\nif (value == null || !value.contains(SignerSignatures.SIGNATURE_SEPARATOR)) {\n  // not a signed value -> force re-login\n}\nString raw = signer.verifyAndExtract(value);","handlingStrategy":"try-catch","validationCode":"boolean looksSigned(String s) { return s != null && s.contains(\"&s=\"); }","typeGuard":null,"tryCatchPattern":"try { String raw = signer.verifyAndExtract(v); } catch (SignerException e) { /* unsigned/foreign value: clear cookie, redirect to re-authentication */ }","preventionTips":["Only feed values produced by Signer.sign() to verifyAndExtract","Check for the '&s=' segment before parsing","Log unsigned-cookie attempts at WARN to detect misconfigured clients"],"tags":["hadoop-auth","signing","cookie","verification"],"backgroundTag":"invalid-signed-token","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}