{"record":{"id":"d040a2d77a8d4667","repo":"apache/hadoop","slug":"no-uri-in-this","errorCode":null,"errorMessage":"No URI in {this}","messagePattern":"No URI in (.+?)","errorType":"exception","errorClass":"DelegationTokenIOException","httpStatus":null,"severity":"error","filePath":"hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/delegation/AbstractS3ATokenIdentifier.java","lineNumber":242,"sourceCode":"   */\n  @Override\n  public void readFields(final DataInput in)\n      throws DelegationTokenIOException, IOException {\n    super.readFields(in);\n    uri = URI.create(Text.readString(in, MAX_TEXT_LENGTH));\n    origin = Text.readString(in, MAX_TEXT_LENGTH);\n    uuid = Text.readString(in, MAX_TEXT_LENGTH);\n    encryptionSecrets.readFields(in);\n    created = in.readLong();\n  }\n\n  /**\n   * Validate the token by looking at its fields.\n   * @throws IOException on failure.\n   */\n  public void validate() throws IOException {\n    if (uri == null) {\n      throw new DelegationTokenIOException(\"No URI in \" + this);\n    }\n  }\n\n  @Override\n  public String toString() {\n    final StringBuilder sb = new StringBuilder(\n        \"S3ATokenIdentifier{\");\n    sb.append(getKind());\n    sb.append(\"; uri=\").append(uri);\n    sb.append(\"; timestamp=\").append(created);\n    sb.append(\"; renewer=\").append(getRenewer());\n    sb.append(\"; encryption=\").append(encryptionSecrets.toString());\n    sb.append(\"; \").append(uuid);\n    sb.append(\"; \").append(origin);\n    sb.append('}');\n    return sb.toString();\n  }\n","sourceCodeStart":224,"sourceCodeEnd":260,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-tools/hadoop-aws/src/main/java/org/apache/hadoop/fs/s3a/auth/delegation/AbstractS3ATokenIdentifier.java#L224-L260","documentation":"Every S3A delegation token identifier must carry the canonical URI of the filesystem it was created for. After a token is decoded, AbstractS3ATokenIdentifier.validate() checks that uri is non-null and throws DelegationTokenIOException ('No URI in ...') otherwise. A null URI means the token payload was never populated correctly for this format, i.e. the token is corrupt or was serialized by an incompatible implementation.","triggerScenarios":"S3ADelegationTokens.decodeTokenIdentifier calls identifier.validate() after token.decodeIdentifier(); readFields populated fields but left uri null. This happens with truncated/foreign token bytes or an identifier class whose serialization does not set the URI.","commonSituations":"Tokens carried across Hadoop versions whose field order/format changed; hand-crafted or test-fabricated identifiers; token bytes mangled in transit or in a credentials store.","solutions":["Discard the token and fetch a fresh one from a filesystem configured for delegation tokens","Align hadoop-aws versions between the token issuer and consumers so serialization matches","If persisting credentials to a file, verify it is written/read as binary without corruption (no text-mode transfer, no partial writes)"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"AbstractS3ATokenIdentifier id = (AbstractS3ATokenIdentifier) token.decodeIdentifier();\nif (id == null || id.getUri() == null) {\n  credentials.removeToken(token.getService());\n  LOG.warn(\"Discarding malformed s3a token for {}\", token.getService());\n}","typeGuard":null,"tryCatchPattern":"try {\n  identifier.validate();\n} catch (DelegationTokenIOException e) {\n  if (e.getMessage().startsWith(\"No URI in\")) {\n    // corrupt/incompatible token: drop it and re-authenticate, do not retry the same token\n    credentials.removeToken(token.getService());\n    tokens.bindToAnyDelegationToken();\n  } else {\n    throw e;\n  }\n}","preventionTips":["Align hadoop-aws versions across token issuers and consumers","Transfer credentials files in binary mode; avoid partial writes","After upgrades, expire and re-issue all delegation tokens"],"tags":["aws","s3a","delegation-token","serialization","validation"],"backgroundTag":"malformed-delegation-token","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}