{"record":{"id":"f9e2231c2406af68","repo":"apache/hadoop","slug":"authenticationtoken-expired","errorCode":null,"errorMessage":"AuthenticationToken expired","messagePattern":"AuthenticationToken expired","errorType":"exception","errorClass":"AuthenticationException","httpStatus":401,"severity":"warning","filePath":"hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java","lineNumber":454,"sourceCode":"            throw new AuthenticationException(\"Unauthorized access\");\n          }\n          try {\n            tokenStr = signer.verifyAndExtract(tokenStr);\n          } catch (SignerException ex) {\n            throw new AuthenticationException(ex);\n          }\n          break;\n        }\n      }\n    }\n    if (tokenStr != null) {\n      token = AuthenticationToken.parse(tokenStr);\n      boolean match = verifyTokenType(getAuthenticationHandler(), token);\n      if (!match) {\n        throw new AuthenticationException(\"Invalid AuthenticationToken type\");\n      }\n      if (token.isExpired()) {\n        throw new AuthenticationException(\"AuthenticationToken expired\");\n      }\n    }\n    return token;\n  }\n\n  /**\n   * This method verifies if the specified token type matches one of the the\n   * token types supported by a specified {@link AuthenticationHandler}. This\n   * method is specifically designed to work with\n   * {@link CompositeAuthenticationHandler} implementation which supports\n   * multiple authentication schemes while the {@link AuthenticationHandler}\n   * interface supports a single type via\n   * {@linkplain AuthenticationHandler#getType()} method.\n   *\n   * @param handler The authentication handler whose supported token types\n   *                should be used for verification.\n   * @param token   The token whose type needs to be verified.\n   * @return true   If the token type matches one of the supported token types","sourceCodeStart":436,"sourceCodeEnd":472,"githubUrl":"https://github.com/apache/hadoop/blob/2add9630210752f88ceb1bb74eb65e37bf41da8e/hadoop-common-project/hadoop-auth/src/main/java/org/apache/hadoop/security/authentication/server/AuthenticationFilter.java#L436-L472","documentation":"The last check in AuthenticationFilter.getToken: a parsed, type-matching token whose expiry (or max-inactive deadline) has passed throws AuthenticationException('AuthenticationToken expired'). Hadoop auth tokens embed 'expires' (issue time + validity) and optionally an 'maxInactive' timestamp; once either is in the past the cookie is dead regardless of signature. Clients are expected to re-authenticate; the browser flow does this transparently, programmatic clients must do it themselves.","triggerScenarios":"Requests arriving with a hadoop.auth cookie older than hadoop.http.authentication.token.validity (default 36000 s = 10 h), or idle longer than authentication.token.max-inactive-interval; server clock changes shifting 'now' past the deadline; jobs resumed after a long pause reusing a serialized token.","commonSituations":"Long-running MR/Spark jobs or notebooks holding web tokens beyond validity; validity lowered for security without clients handling re-auth; clock skew between token-issuing and token-validating nodes when a shared secret is used across services; users leaving a UI tab open overnight.","solutions":["Re-authenticate to get a fresh token: programmatic clients catch AuthenticationException and rerun Authenticator.authenticate(url, token) (or UserGroupInformation relogin in kerberos setups), then retry.","Raise validity server-side if workflows legitimately outlive it: hadoop.http.authentication.token.validity (seconds) in the service's auth config.","For idle expiry, review authentication.token.max-inactive-interval vs. your session patterns.","Check clock synchronization (NTP/chrony) across token issuers and validators.","Serialize/replay tokens only within their lifetime; refresh proactively before expiry rather than on failure."],"exampleFix":"// before\ntry { conn = new AuthenticatedURL().openConnection(url, token); }\ncatch (AuthenticationException e) { throw new RuntimeException(e); }\n\n// after\ntry { conn = new AuthenticatedURL().openConnection(url, token); }\ncatch (AuthenticationException e) {\n  if (e.getMessage().contains(EXPIRED)) {\n    token = new AuthenticatedURL.Token();\n    new KerberosAuthenticator().authenticate(url, token);\n    conn = new AuthenticatedURL().openConnection(url, token);\n  } else { throw e; }\n}","handlingStrategy":"try-catch","validationCode":"// proactive refresh before expiry if you can introspect the token\nlong expires = parseExpiresFromToken(tokenStr);\nif (expires - System.currentTimeMillis() < REFRESH_MARGIN_MS) {\n  authenticator.authenticate(url, token);\n}","typeGuard":null,"tryCatchPattern":"try {\n  conn = new AuthenticatedURL().openConnection(url, token);\n} catch (AuthenticationException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"expired\")) {\n    token = new AuthenticatedURL.Token();\n    authenticator.authenticate(url, token);\n    conn = new AuthenticatedURL().openConnection(url, token);\n  } else { throw e; }\n}","preventionTips":["Catch expired-token errors and re-authenticate instead of failing jobs.","Align client workflows with hadoop.http.authentication.token.validity; raise it if jobs legitimately run longer.","Use kerberos relogin (UserGroupInformation.reloginFromKeytab) before long jobs to refresh tokens.","Keep NTP/chrony healthy across issuers and validators."],"tags":["authentication","token-expired","hadoop-auth","auth-cookie","session-validity"],"backgroundTag":"auth-token-expired","analyzedSha":"2add9630210752f88ceb1bb74eb65e37bf41da8e","analyzedAt":"2026-08-22T19:55:07.957Z","schemaVersion":2},"datasetVersion":"2026-08-22T20:17:22.307Z"}