{"record":{"id":"d4718ca96d356687","repo":"apache/hadoop","slug":"checkaccess-is-not-supported-for-httpfs-on-0-pl","errorCode":null,"errorMessage":"checkaccess is not supported for HttpFs on {0}. Please check your fs.defaultFS configuration","messagePattern":"checkaccess is not supported for HttpFs on (.+?)\\. Please check your fs\\.defaultFS configuration","errorType":"exception","errorClass":"UnsupportedOperationException","httpStatus":400,"severity":"error","filePath":"hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/FSOperations.java","lineNumber":2099,"sourceCode":"     */\n    public FSAccess(String path, FsAction mode) {\n      this.path = new Path(path);\n      this.mode = mode;\n    }\n\n    /**\n     * Executes the filesystem operation.\n     * @param fs filesystem instance to use.\n     * @throws IOException thrown if an IO error occurred.\n     */\n    @Override\n    public Void execute(FileSystem fs) throws IOException {\n      if (fs instanceof DistributedFileSystem) {\n        DistributedFileSystem dfs = (DistributedFileSystem) fs;\n        dfs.access(path, mode);\n        HttpFSServerWebApp.get().getMetrics().incrOpsCheckAccess();\n      } else {\n        throw new UnsupportedOperationException(\"checkaccess is \"\n            + \"not supported for HttpFs on \" + fs.getClass()\n            + \". Please check your fs.defaultFS configuration\");\n      }\n      return null;\n    }\n  }\n\n  /**\n   * Executor that performs a setErasureCodingPolicy operation.\n   */\n  @InterfaceAudience.Private\n  public static class FSSetErasureCodingPolicy\n      implements FileSystemAccess.FileSystemExecutor<Void> {\n\n    private Path path;\n    private String policyName;\n\n    public FSSetErasureCodingPolicy(String path, String policyName) {","sourceCodeStart":2081,"sourceCodeEnd":2117,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-hdfs-project/hadoop-hdfs-httpfs/src/main/java/org/apache/hadoop/fs/http/server/FSOperations.java#L2081-L2117","documentation":"FSOperations.FSAccess.execute() runs CHECKACCESS through DistributedFileSystem.access(path, mode); there is no generic FileSystem access-check API, so any other backing filesystem throws UnsupportedOperationException (HTTP 400 to REST clients). Note the metrics increment (incrOpsCheckAccess) only happens on the HDFS path, so failed calls are also uncounted.","triggerScenarios":"Client sends op=CHECKACCESS with fsaction=N/A params via webhdfs:// while HttpFS's filesystem is not DistributedFileSystem.","commonSituations":"Authorization pre-checks in apps (can this user read/write this path) routed through an HttpFS gateway on object storage; test harness with local FS; fs.defaultFS missing in server config.","solutions":["Set fs.defaultFS=hdfs://<nameservice> in the HttpFS server configuration and restart","If backing is intentionally non-HDFS, replace CHECKACCESS with an open/append probe or the store's own permission model","Use WebHDFS directly against the NameNode for access checks","Verify with curl that LISTSTATUS succeeds (gateway healthy) and only CHECKACCESS fails (capability gap), isolating the cause"],"exampleFix":"<!-- before: httpfs-site.xml -->\n<property><name>fs.defaultFS</name><value>file:///</value></property>\n<!-- after -->\n<property><name>fs.defaultFS</name><value>hdfs://ns1</value></property>\n<!-- restart HttpFS; CHECKACCESS then delegates to DFS access() -->","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"static DistributedFileSystem asDfs(FileSystem fs) {\n  return fs instanceof DistributedFileSystem ? (DistributedFileSystem) fs : null;\n}","tryCatchPattern":"try {\n  fs.access(path, FsAction.READ_WRITE);\n} catch (IOException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"not supported for HttpFs\")) {\n    // capability gap, not a denial: fall back to an existence probe\n    return fs.exists(path);\n  }\n  throw e;\n}","preventionTips":["Do not build authorization decisions on CHECKACCESS through gateways of unknown backing","Distinguish 400 'not supported' from real AccessControlException before failing users","Fix fs.defaultFS on the HttpFS server when HDFS access checks are required"],"tags":["httpfs","webhdfs","checkaccess","permissions","unsupported-operation","fs-defaultfs"],"backgroundTag":"unsupported-filesystem-operation","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}