{"record":{"id":"d428327d76389def","repo":"apache/hadoop","slug":"unexpected-value-in-xframeoption","errorCode":null,"errorMessage":"Unexpected value in xFrameOption.","messagePattern":"Unexpected value in xFrameOption\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java","lineNumber":2015,"sourceCode":"      return this.name;\n    }\n\n    /**\n     * We cannot use valueOf since the AllowFrom enum differs from its value\n     * Allow-From. This is a helper method that does exactly what valueof does,\n     * but allows us to handle the AllowFrom issue gracefully.\n     *\n     * @param value - String must be DENY, SAMEORIGIN or ALLOW-FROM.\n     * @return XFrameOption or throws IllegalException.\n     */\n    private static XFrameOption getEnum(String value) {\n      Preconditions.checkState(value != null && !value.isEmpty());\n      for (XFrameOption xoption : values()) {\n        if (value.equals(xoption.toString())) {\n          return xoption;\n        }\n      }\n      throw new IllegalArgumentException(\"Unexpected value in xFrameOption.\");\n    }\n  }\n\n\n  private Map<String, String> setHeaders(Configuration conf) {\n    Map<String, String> xFrameParams = new HashMap<>();\n    Map<String, String> headerConfigMap =\n            conf.getValByRegex(HTTP_HEADER_REGEX);\n\n    xFrameParams.putAll(getDefaultHeaders());\n    if(this.xFrameOptionIsEnabled) {\n      xFrameParams.put(HTTP_HEADER_PREFIX+X_FRAME_OPTIONS,\n              this.xFrameOption.toString());\n    }\n    xFrameParams.putAll(headerConfigMap);\n    return xFrameParams;\n  }\n","sourceCodeStart":1997,"sourceCodeEnd":2033,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/http/HttpServer2.java#L1997-L2033","documentation":"HttpServer2.XFrameOption.getEnum() does a case-sensitive exact string match against the three allowed values 'DENY', 'SAMEORIGIN', and 'ALLOW-FROM' (the enum constant is ALLOWFROM, but toString() returns 'ALLOW-FROM', so even 'ALLOWFROM' without the dash is rejected). An invalid value throws IllegalArgumentException at builder time, failing daemon startup. The value comes from each service's xframe config, e.g. dfs.namenode.http.xframe.value for NameNode/Secondary/JournalNode, or Builder.setXFrameOption directly.","triggerScenarios":"Setting dfs.namenode.http.xframe.value (or the YARN/webapp equivalent) to a lowercase or free-form value like 'sameorigin', 'allow-all', or 'ALLOWFROM'; passing such a string to HttpServer2.Builder.setXFrameOption in an embedded service.","commonSituations":"Hardening passes that add clickjacking protection with a copied config snippet from another product (which allows different tokens); operators assuming header values are case-insensitive.","solutions":["Set the property to exactly one of DENY, SAMEORIGIN, or ALLOW-FROM (uppercase, dash included)","If unsure, omit the value: services default to SAMEORIGIN","Check every node's config for the stray value, since the failing daemon names itself in the log"],"exampleFix":"<!-- hdfs-site.xml before -->\n<property><name>dfs.namenode.http.xframe.value</name><value>sameorigin</value></property>\n\n<!-- after -->\n<property><name>dfs.namenode.http.xframe.value</name><value>SAMEORIGIN</value></property>","handlingStrategy":"validation","validationCode":"private static final Set<String> XFRAME_ALLOWED =\n    Set.of(\"DENY\", \"SAMEORIGIN\", \"ALLOW-FROM\");\nString value = conf.getTrimmed(\"dfs.namenode.http.xframe.value\", \"SAMEORIGIN\");\nif (!XFRAME_ALLOWED.contains(value)) {\n  throw new ConfigValidationException(\n      \"xframe value must be one of DENY, SAMEORIGIN, ALLOW-FROM (case-sensitive): \" + value);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy the exact allowed tokens (uppercase, ALLOW-FROM with dash) into config templates","Add a config lint rule for xframe properties in deployment tooling","Remember 'ALLOWFROM' (no dash) and lowercase variants are rejected"],"tags":["hadoop","http-server","xframe-options","configuration","security-headers"],"backgroundTag":"invalid-enum-config-value","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-23T01:17:44.959Z"}