HDFS-10756 added the getTrashRoot() support for WebHdfs. However, it was done by creating a FileSystem instance in the namenode. This is unacceptable for many reasons and also the implementation is not correct. The current implementation only works when security is off. When security is on, the internal client received AccessControlException and does not work.
A similar bug was preset in
HDFS-11156. Again, this is not merely a "performance bug". These don't work with security on. Fortunately HDFS-11156 was reverted and reworked. I've recently reverted it and ported the rework to branch-2.10.
HDFS-10756 can be remedied quickly, it needs to be reverted.