{"record":{"id":"ab055a7e77627e97","repo":"apache/hadoop","slug":"unauthorized-access","errorCode":null,"errorMessage":"Unauthorized access","messagePattern":"Unauthorized access","errorType":"exception","errorClass":"AuthenticationException","httpStatus":401,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java","lineNumber":436,"sourceCode":"   * to perform user authentication.\n   *\n   * @param request request object.\n   *\n   * @return the Authentication token if the request is authenticated, <code>null</code> otherwise.\n   *\n   * @throws IOException thrown if an IO error occurred.\n   * @throws AuthenticationException thrown if the token is invalid or if it has expired.\n   */\n  protected AuthenticationToken getToken(HttpServletRequest request) throws IOException, AuthenticationException {\n    AuthenticationToken token = null;\n    String tokenStr = null;\n    Cookie[] cookies = request.getCookies();\n    if (cookies != null) {\n      for (Cookie cookie : cookies) {\n        if (cookie.getName().equals(AuthenticatedURL.AUTH_COOKIE)) {\n          tokenStr = cookie.getValue();\n          if (tokenStr.isEmpty()) {\n            throw new AuthenticationException(\"Unauthorized access\");\n          }\n          try {\n            tokenStr = signer.verifyAndExtract(tokenStr);\n          } catch (SignerException ex) {\n            throw new AuthenticationException(ex);\n          }\n          break;\n        }\n      }\n    }\n    if (tokenStr != null) {\n      token = AuthenticationToken.parse(tokenStr);\n      boolean match = verifyTokenType(getAuthenticationHandler(), token);\n      if (!match) {\n        throw new AuthenticationException(\"Invalid AuthenticationToken type\");\n      }\n      if (token.isExpired()) {\n        throw new AuthenticationException(\"AuthenticationToken expired\");","sourceCodeStart":418,"sourceCodeEnd":454,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java#L418-L454","documentation":"AuthenticationFilter.getToken extracts the hadoop.auth cookie from the request; if the cookie exists but its value is the empty string, it throws AuthenticationException('Unauthorized access') before signature verification — an empty cookie is treated as an explicit 'no credentials'. The client is then expected to authenticate (which sends it through the handler and issues a fresh signed cookie).","triggerScenarios":"A browser or client sends 'hadoop.auth=' (empty value): previous logout cleared the value but left the cookie; cookie rewritten/blanked by a proxy or client cookie jar bug; multiple web apps on the same host overwriting the cookie name; manually constructed Cookie headers with no value.","commonSituations":"After logout flows that expire the cookie by blanking it; cookie-name collision when several Hadoop web UIs share a host and path scope; clients copying Cookie headers between requests and dropping the value; intermediary caches/CDNs mangling Set-Cookie.","solutions":["Client side: clear the hadoop.auth cookie entirely (or use a fresh/incognito session) and access the URL again to trigger a new authentication.","Server/app side: on logout, expire the cookie properly (Max-Age=0) instead of setting an empty value.","Give each web app its own cookie domain/path scope so the same cookie name cannot be blanked by a sibling app.","If a proxy rewrites cookies, disable cookie modification for the hadoop.auth name or bypass the proxy for the UI."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// client side: only send a non-empty cookie\nString cookie = cookieStore.get(\"hadoop.auth\");\nif (cookie == null || cookie.isEmpty()) {\n  cookieStore.remove(\"hadoop.auth\"); // force clean re-authentication\n}","typeGuard":null,"tryCatchPattern":"try {\n  new AuthenticatedURL().openConnection(url, token);\n} catch (AuthenticationException e) {\n  if (\"Unauthorized access\".equals(e.getMessage())) {\n    token = new AuthenticatedURL.Token(); // drop blank/invalid cookie and re-auth\n    new AuthenticatedURL().openConnection(url, token);\n  } else { throw e; }\n}","preventionTips":["Clear hadoop.auth cookies fully on logout (Max-Age=0), never blank the value.","Scope cookie paths/domains per web app to avoid cross-app blanking.","Send clients to a clean session when complaints of instant 'Unauthorized access' appear."],"tags":["authentication","cookie","hadoop-auth","unauthorized","empty-cookie"],"backgroundTag":"auth-cookie-invalid","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}