{"record":{"id":"c05007cc93e8b590","repo":"apache/hadoop","slug":"invalid-authentication-token","errorCode":null,"errorMessage":"Invalid authentication token","messagePattern":"Invalid authentication token","errorType":"exception","errorClass":"AuthenticationException","httpStatus":401,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/AuthToken.java","lineNumber":244,"sourceCode":"\n  /**\n   * Splits the string representation of a token into attributes pairs.\n   *\n   * @param tokenStr string representation of a token.\n   *\n   * @return a map with the attribute pairs of the token.\n   *\n   * @throws AuthenticationException thrown if the string representation of the token could not be broken into\n   * attribute pairs.\n   */\n  private static Map<String, String> split(String tokenStr) throws AuthenticationException {\n    Map<String, String> map = new HashMap<String, String>();\n    StringTokenizer st = new StringTokenizer(tokenStr, ATTR_SEPARATOR);\n    while (st.hasMoreTokens()) {\n      String part = st.nextToken();\n      int separator = part.indexOf('=');\n      if (separator == -1) {\n        throw new AuthenticationException(\"Invalid authentication token\");\n      }\n      String key = part.substring(0, separator);\n      String value = part.substring(separator + 1);\n      map.put(key, value);\n    }\n    return map;\n  }\n\n}\n","sourceCodeStart":226,"sourceCodeEnd":254,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/util/AuthToken.java#L226-L254","documentation":"The private split() helper inside AuthToken breaks the token string on '&' and expects every segment to be a 'key=value' pair. Any segment that contains no '=' character means the string is not a well-formed attribute list, and this AuthenticationException is thrown from AuthToken.parse().","triggerScenarios":"AuthToken.parse() receives a string like 'u=alice&garbage' or a bare fragment such as 'u=alice&p' ; an attribute value containing an unencoded '&' is split mid-value and leaves a segment without '='; a cookie value cut at an arbitrary offset by truncation.","commonSituations":"Building token strings by string concatenation without URL-encoding values that contain '&' or '='; a proxy or framework mangling the cookie (double-decoding, partial rewriting); tampered cookies sent by a client.","solutions":["URL-encode every attribute value when assembling token or cookie strings so '&' and '=' never appear raw","Log the offending segment to find which value introduced the stray '&'","Reject the token and redirect the client through re-authentication instead of trying to repair it"],"exampleFix":"// before: raw concatenation, principal may contain '&' or '='\nString tokenStr = \"u=\" + user + \"&p=\" + principal + \"&t=hadoop&e=\" + exp;\n\n// after: encode each value\nString tokenStr = \"u=\" + URLEncoder.encode(user, UTF_8)\n    + \"&p=\" + URLEncoder.encode(principal, UTF_8)\n    + \"&t=hadoop&e=\" + exp;","handlingStrategy":"validation","validationCode":"boolean segmentsWellFormed(String tokenStr) {\n  for (String part : tokenStr.split(\"&\")) {\n    if (!part.isEmpty() && !part.substring(1).isEmpty() && part.indexOf('=') < 0) return false;\n    if (part.indexOf('=') < 0 && !part.isEmpty()) return false;\n  }\n  return true;\n}","typeGuard":null,"tryCatchPattern":"try { AuthToken.parse(str); } catch (AuthenticationException e) { /* reject token, re-authenticate */ }","preventionTips":["URL-encode all attribute values when building cookie/token strings","Never place raw '&' or '=' inside attribute values","Add integration tests with principals containing special characters"],"tags":["hadoop-auth","authentication","token-parsing","url-encoding"],"backgroundTag":"auth-token-parse-failure","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}