{"record":{"id":"ad938247cdf2bfca","repo":"apache/hadoop","slug":"url-must-be-for-a-http-or-https-resource","errorCode":null,"errorMessage":"url must be for a HTTP or HTTPS resource","messagePattern":"url must be for a HTTP or HTTPS resource","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java","lineNumber":348,"sourceCode":"  }\n\n  /**\n   * Returns an authenticated {@link HttpURLConnection}.\n   *\n   * @param url the URL to connect to. Only HTTP/S URLs are supported.\n   * @param token the authentication token being used for the user.\n   *\n   * @return an authenticated {@link HttpURLConnection}.\n   *\n   * @throws IOException if an IO error occurred.\n   * @throws AuthenticationException if an authentication exception occurred.\n   */\n  public HttpURLConnection openConnection(URL url, Token token) throws IOException, AuthenticationException {\n    if (url == null) {\n      throw new IllegalArgumentException(\"url cannot be NULL\");\n    }\n    if (!url.getProtocol().equalsIgnoreCase(\"http\") && !url.getProtocol().equalsIgnoreCase(\"https\")) {\n      throw new IllegalArgumentException(\"url must be for a HTTP or HTTPS resource\");\n    }\n    if (token == null) {\n      throw new IllegalArgumentException(\"token cannot be NULL\");\n    }\n    authenticator.authenticate(url, token);\n\n    // allow the token to create the connection with a cookie handler for\n    // managing session cookies.\n    return token.openConnection(url, connConfigurator);\n  }\n\n  /**\n   * Helper method that injects an authentication token to send with a\n   * connection. Callers should prefer using\n   * {@link Token#openConnection(URL, ConnectionConfigurator)} which\n   * automatically manages authentication tokens.\n   *\n   * @param conn connection to inject the authentication token into.","sourceCodeStart":330,"sourceCodeEnd":366,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java#L330-L366","documentation":"AuthenticatedURL only speaks plain HTTP/S: after the null check it requires the URL protocol to be http or https (case-insensitive) and otherwise throws IllegalArgumentException('url must be for a HTTP or HTTPS resource'). This is because the class authenticates over HttpURLConnection cookies/SPNEGO at the HTTP layer, not over Hadoop RPC or other schemes. Passing hdfs://, webhdfs:// (the REST scheme), ftp://, or file:// URLs hits this guard.","triggerScenarios":"Constructing a URL from an HDFS URI (hdfs://nn:8020/path) instead of the service's HTTP endpoint (http://nn:9874/... or the WebHDFS http endpoint http://nn:9870/webhdfs/v1/...); parsing a string like webhdfs://host:9870/... that was never converted to http; hardcoded ftp:// or file:// test URLs.","commonSituations":"Copying filesystem URIs from core-site fs.defaultFS into client code that talks to the NameNode/JobHistory/ATS web endpoints; tools that accept one URI and must talk to both RPC and HTTP planes; new WebHDFS users unaware the http(s) scheme is required for the REST layer.","solutions":["Use the HTTP endpoint: http://host:port/... — for WebHDFS REST, http://nn:9870/webhdfs/v1<path>?op=... (or the https port with SSL enabled).","Convert scheme programmatically when reusing a WebHDFS URI: new URI('http', uri.getUserInfo(), uri.getHost(), port, uri.getPath(), ...) or simple scheme replacement webhdfs->http / swebhdfs->https.","Check the service's documented HTTP port (NameNode UI / httpfs / ATS) rather than reusing the RPC port.","Add a startup assertion on url.getProtocol() to fail with your own message naming the bad value."],"exampleFix":"// before\nURL u = new URL('webhdfs://nn:9870/webhdfs/v1/data?f=1'); // non-HTTP scheme\nnew AuthenticatedURL().openConnection(u, token);\n\n// after\nURL u = new URL('http://nn:9870/webhdfs/v1/data?op=OPEN&...');\nnew AuthenticatedURL().openConnection(u, token);","handlingStrategy":"validation","validationCode":"String proto = url.getProtocol();\nif (!(\"http\".equalsIgnoreCase(proto) || \"https\".equalsIgnoreCase(proto))) {\n  throw new IllegalArgumentException(\"AuthenticatedURL needs http/https, got: \" + proto);\n}","typeGuard":"static boolean isHttpUrl(URL u) {\n  String p = u.getProtocol();\n  return \"http\".equalsIgnoreCase(p) || \"https\".equalsIgnoreCase(p);\n}","tryCatchPattern":null,"preventionTips":["Never feed fs.defaultFS or webhdfs:// URIs to AuthenticatedURL; convert to the http/https endpoint.","Keep service HTTP endpoints in dedicated config keys, separate from RPC URIs.","Assert the scheme in shared HTTP-client utilities at construction time."],"tags":["authentication","url","protocol-validation","hadoop-auth","webhdfs"],"backgroundTag":"unsupported-url-scheme","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}