Authentication over HTTP is enabled. It is strongly recommen

Error message

Authentication over HTTP is enabled. It is strongly recommended that you do not enable this on a public network!

What it means

Jib warns when the sendCredentialsOverHttp system property is enabled, causing registry credentials to be sent over an unencrypted HTTP connection. This risks credential interception, so the library logs a strong security warning rather than silently proceeding.

Source

Thrown at jib-plugins-common/src/main/java/com/google/cloud/tools/jib/plugins/common/PluginConfigurationProcessor.java:483

  @VisibleForTesting
  static JibContainerBuilder processCommonConfiguration(
      RawConfiguration rawConfiguration,
      InferredAuthProvider inferredAuthProvider,
      ProjectProperties projectProperties,
      Containerizer containerizer)
      throws InvalidImageReferenceException, MainClassInferenceException, InvalidAppRootException,
          IOException, InvalidWorkingDirectoryException, InvalidPlatformException,
          InvalidContainerVolumeException, IncompatibleBaseImageJavaVersionException,
          NumberFormatException, InvalidContainerizingModeException,
          InvalidFilesModificationTimeException, InvalidCreationTimeException,
          ExtraDirectoryNotFoundException {
    JibSystemProperties.checkHttpTimeoutProperty();
    JibSystemProperties.checkProxyPortProperty();

    if (JibSystemProperties.sendCredentialsOverHttp()) {
      projectProperties.log(
          LogEvent.warn(
              "Authentication over HTTP is enabled. It is strongly recommended that you do not "
                  + "enable this on a public network!"));
    }

    configureContainerizer(containerizer, rawConfiguration, projectProperties);

    return processCommonConfiguration(rawConfiguration, inferredAuthProvider, projectProperties);
  }

  /**
   * Returns a {@link JavaContainerBuilder} with the correctly parsed base image configuration.
   *
   * @param rawConfiguration contains the base image configuration
   * @param projectProperties used for providing additional information
   * @param inferredAuthProvider provides inferred auths for registry images
   * @return a new {@link JavaContainerBuilder} with the configured base image
   * @throws IncompatibleBaseImageJavaVersionException when the Java version in the base image is
   *     incompatible with the Java version of the application to be containerized

View on GitHub (pinned to fb949e2676)

Solutions

Remove the -DsendCredentialsOverHttp=true flag and use an HTTPS registry endpoint
Enable TLS on the private registry (e.g. behind a reverse proxy with a valid certificate)
If the registry must stay HTTP, restrict it to a trusted/isolated network or localhost only
Use registry-specific insecure-registry configuration of the container runtime instead of sending real credentials over HTTP

Example fix

// before
mvn jib:build -Djib.to.image=http://registry:5000/myapp -DsendCredentialsOverHttp=true
// after
mvn jib:build -Djib.to.image=registry:5000/myapp  // registry served over HTTPS

Defensive patterns

Strategy: validation

Validate before calling

if (Boolean.getBoolean("sendCredentialsOverHttp")) {
  System.out.println("WARNING: credentials will be sent over plain HTTP");
}

Try / catch

try {
  buildImage();
} catch (RegistryUnauthorizedException e) {
  // do NOT 'fix' by enabling sendCredentialsOverHttp; fix TLS/auth instead
  throw new IllegalStateException("Configure HTTPS registry and correct credentials", e);
}

Prevention

Never enable sendCredentialsOverHttp in CI or on public networks
Serve all registries over HTTPS with valid certificates
Restrict HTTP-only registries to localhost or isolated networks

When it happens

Trigger: Running Jib with -DsendCredentialsOverHttp=true while the target registry is reached over an http:// registry URL or plain-HTTP endpoint.

Common situations: Pushing to an insecure internal registry (e.g. localhost:5000 or an HTTP-only private registry) without TLS; misconfigured registry URL using http:// instead of https://.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/ed22121b144f9329. Report an issue: GitHub.