{"record":{"id":"ebe2c0284245b3bb","repo":"apache/hadoop","slug":"tokenstr-cannot-be-null","errorCode":null,"errorMessage":"tokenStr cannot be null","messagePattern":"tokenStr cannot be null","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java","lineNumber":190,"sourceCode":"   */\n  public static class Token {\n\n    private final AuthCookieHandler cookieHandler = new AuthCookieHandler();\n\n    /**\n     * Creates a token.\n     */\n    public Token() {\n    }\n\n    /**\n     * Creates a token using an existing string representation of the token.\n     *\n     * @param tokenStr string representation of the tokenStr.\n     */\n    public Token(String tokenStr) {\n      if (tokenStr == null) {\n        throw new IllegalArgumentException(\"tokenStr cannot be null\");\n      }\n      set(tokenStr);\n    }\n\n    /**\n     * Returns if a token from the server has been set.\n     *\n     * @return if a token from the server has been set.\n     */\n    public boolean isSet() {\n      return cookieHandler.getAuthCookie() != null;\n    }\n\n    /**\n     * Sets a token.\n     *\n     * @param tokenStr string representation of the tokenStr.\n     */","sourceCodeStart":172,"sourceCodeEnd":208,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/client/AuthenticatedURL.java#L172-L208","documentation":"AuthenticatedURL.Token is the holder for the hadoop.auth authentication cookie. The Token(String) constructor requires a string representation obtained earlier (e.g. from a serialized credential) and rejects null immediately with IllegalArgumentException because a null token string has no meaning — there is nothing to restore. This is a fail-fast precondition, not a server interaction.","triggerScenarios":"Reconstructing a Token from persistence (file, distributed cache, YARN credential transfer, CLI argument) where the source was absent/empty and the loader returned null: new AuthenticatedURL.Token(System.getProperty(...)), token forwarding code that did not check presence first.","commonSituations":"Passing a token around via command line or config where the variable is optional and unset; a delegated task (MR reducer talking to a web endpoint) receiving credentials only when kerberos is enabled while the code assumes always; refactors that moved token loading after the constructor call.","solutions":["Null-check before construction and fall back to fresh authentication: if (tokenStr == null) { authenticator.authenticate(url, new Token()); } else { token = new Token(tokenStr); }","Fix the producer that yields null — an optional credential should be an explicit Optional.empty()/absent, not null.","Log which source (file/property/UGI credential) was consulted to make the missing-token case diagnosable.","When forwarding tokens in distributed jobs, always serialize with Token.toString() on the producer side so the consumer never sees null."],"exampleFix":"// before\nToken token = new AuthenticatedURL.Token(tokenStr); // tokenStr may be null\n\n// after\nToken token = (tokenStr != null) ? new AuthenticatedURL.Token(tokenStr) : new AuthenticatedURL.Token();\nif (!token.isSet()) { authenticator.authenticate(url, token); }","handlingStrategy":"validation","validationCode":"if (tokenStr == null) { authenticator.authenticate(url, token); /* fresh token */ }\nelse { token = new AuthenticatedURL.Token(tokenStr); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Represent absent credentials as Optional/absent, never null strings.","Validate token sources (files, properties) at load time with clear messages.","Always serialize tokens with toString() on the producer so consumers never see null."],"tags":["authentication","token","null-argument","hadoop-auth","precondition"],"backgroundTag":"null-argument","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}