{"record":{"id":"b46b7b0753f34b15","repo":"apache/hadoop","slug":"parameter-is-not-null","errorCode":null,"errorMessage":"{} parameter is not null.","messagePattern":"(.+?) parameter is not null\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/web/resources/NamenodeWebHdfsMethods.java","lineNumber":1448,"sourceCode":"      return Response.ok(js).type(MediaType.APPLICATION_JSON).build();\n    }\n    case GETFILECHECKSUM:\n    {\n      final NameNode namenode = (NameNode)context.getAttribute(\"name.node\");\n      final URI uri = redirectURI(null, namenode, ugi, delegation, username,\n          doAsUser, fullpath, op.getValue(), -1L, -1L, null);\n      if(!noredirectParam.getValue()) {\n        return Response.temporaryRedirect(uri)\n          .type(MediaType.APPLICATION_OCTET_STREAM).build();\n      } else {\n        final String js = JsonUtil.toJsonString(\"Location\", uri);\n        return Response.ok(js).type(MediaType.APPLICATION_JSON).build();\n      }\n    }\n    case GETDELEGATIONTOKEN:\n    {\n      if (delegation.getValue() != null) {\n        throw new IllegalArgumentException(delegation.getName()\n            + \" parameter is not null.\");\n      }\n      final Token<? extends TokenIdentifier> token = generateDelegationToken(\n          ugi, renewer.getValue());\n\n      final String setServiceName = tokenService.getValue();\n      final String setKind = tokenKind.getValue();\n      if (setServiceName != null) {\n        token.setService(new Text(setServiceName));\n      }\n      if (setKind != null) {\n        token.setKind(new Text(setKind));\n      }\n      final String js = JsonUtil.toJsonString(token);\n      return Response.ok(js).type(MediaType.APPLICATION_JSON).build();\n    }\n    case GETHOMEDIRECTORY: {\n      String userHome = DFSUtilClient.getHomeDirectory(conf, ugi);","sourceCodeStart":1430,"sourceCodeEnd":1466,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs/src/main/java/org/apache/hadoop/hdfs/server/namenode/web/resources/NamenodeWebHdfsMethods.java#L1430-L1466","documentation":"Guard inside the GET op=GETDELEGATIONTOKEN handler. Acquiring a delegation token must run under a real authentication identity (Kerberos/SPNEGO, or user.name in simple mode). If the request also carries the delegation query parameter — i.e. it tries to authenticate with an existing token — the handler throws IllegalArgumentException('<delegation> parameter is not null.') and the client sees HTTP 400. You cannot mint a delegation token while presenting one.","triggerScenarios":"GET /webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer=<user>&delegation=<existingToken>. Typical of clients that merge all previously seen query parameters onto every subsequent request, or token-refresh workflows that reuse an authenticated URL as a template.","commonSituations":"Generic REST wrappers that keep one parameter map per session; copy-pasting a URL from the audit log (it contains the delegation token used earlier); downstream services fetching their own token while a shared token is already in the request context.","solutions":["Remove the delegation parameter from the GETDELEGATIONTOKEN request URL","Authenticate for this one call with Kerberos (SPNEGO) or &user.name=<user> instead","If a valid token already exists, reuse it rather than requesting another","Audit client code that blindly forwards stored parameters onto each request"],"exampleFix":"# before\ncurl \"http://nn:9870/webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer=oozie&delegation=EAo...\"\n# 400 ... IllegalArgumentException: delegation parameter is not null.\n\n# after\ncurl --negotiate -u : \"http://nn:9870/webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer=oozie\"","handlingStrategy":"validation","validationCode":"static String getDelegationTokenUrl(String renewer) {\n  // acquisition must use real auth: never attach the delegation parameter here\n  return \"/webhdfs/v1/?op=GETDELEGATIONTOKEN&renewer=\"\n      + URLEncoder.encode(renewer, StandardCharsets.UTF_8);\n}","typeGuard":null,"tryCatchPattern":"catch (IOException e) { // 400 ... delegation parameter is not null.\n  if (e.getMessage() != null && e.getMessage().contains(\"delegation parameter is not null\")) {\n    // strip stored token from URL and re-authenticate with kerberos/user.name\n  } else throw e;\n}","preventionTips":["Keep a dedicated URL builder for token acquisition that never forwards stored credentials","Separate session-auth parameters from per-op parameters in client state","Never copy request URLs from audit logs back into code — they embed tokens"],"tags":["webhdfs","hdfs","delegation-token","authentication","rest-api","security"],"backgroundTag":"delegation-token-misuse","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}