t8y2/dbx · error

reader cannot read token payload

Error message

reader cannot read token payload

What it means

While decoding a length-prefixed Hadoop token field, the library has read the field length and needs to io.ReadFull the payload, which requires the reader to also implement io.Reader. The io.ByteReader passed in is expected to be *strings.Reader, so this error only fires if the concrete reader type cannot read raw bytes. For a developer, it is effectively an internal invariant failure in token decoding, not a config problem.

Source

Thrown at agents/drivers/argo-go/config.go:812

	}
	return identifier, password, nil
}

func readHadoopByteArray(reader io.ByteReader) ([]byte, error) {
	length, err := readHadoopVInt(reader)
	if err != nil {
		return nil, err
	}
	if length < 0 {
		return nil, fmt.Errorf("negative length %d", length)
	}
	if length > 64*1024*1024 {
		return nil, fmt.Errorf("length %d exceeds limit", length)
	}
	value := make([]byte, int(length))
	byteReader, ok := reader.(io.Reader)
	if !ok {
		return nil, errors.New("reader cannot read token payload")
	}
	if _, err := io.ReadFull(byteReader, value); err != nil {
		return nil, err
	}
	return value, nil
}

func readHadoopVInt(reader io.ByteReader) (int64, error) {
	firstByte, err := reader.ReadByte()
	if err != nil {
		return 0, err
	}
	first := int8(firstByte)
	if first >= -112 {
		return int64(first), nil
	}
	length := -111 - int(first)
	negative := false

View on GitHub (pinned to c0390bff16)

Solutions

1. If you hit this via the public API, report it — it indicates an internal regression; the reader should always be *strings.Reader.
2. If you call readHadoopByteArray directly, pass a reader implementing both io.ByteReader and io.Reader (e.g. strings.Reader, bytes.Reader, bufio.Reader).
3. Avoid wrapping the reader in a type that only satisfies io.ByteReader before calling the decoder.

Example fix

// before
var r io.ByteReader = myByteOnlyReader{buf}
identifier, err := readHadoopByteArray(r)
// after
reader := strings.NewReader(string(decoded))
identifier, err := readHadoopByteArray(reader) // *strings.Reader is both ByteReader and Reader

func asFullReader(r io.ByteReader) (io.Reader, bool) {
	rr, ok := r.(io.Reader)
	return rr, ok
}

if err := driver.Connect(cfg); err != nil {
	if strings.Contains(err.Error(), "reader cannot read token payload") {
		// internal decoder regression: check driver version, upgrade
	}
	return err
}

When it happens

Trigger: Calling readHadoopByteArray with an io.ByteReader implementation that does not also implement io.Reader. In the shipped code path the reader is always *strings.Reader, so the error is practically unreachable via public API; it can only be hit by tests or custom code reusing readHadoopByteArray with a ByteReader-only wrapper.

Common situations: Custom tooling that reuses the driver's internal token-decoding helpers with a bufio.Reader stripped or wrapped type; refactors that change the reader type passed into decodeHadoopDelegationToken.

Related errors

• reader cannot read token payload
• Custom H2 JDBC JAR does not exist: " + path
• H2 MVStore file is too small to contain valid headers: " + f
• Failed to read CLOB value
• Hive host is required

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/11d62302a10e8705. Report an issue: GitHub.