For security reasons, OAuth authentication should use HTTPS.

Error message

For security reasons, OAuth authentication should use HTTPS. You should set the property 'Administration > Configuration > Server base URL' to an HTTPS URL.

What it means

LogOAuthWarning warns at startup when OAuth authentication providers are configured but the server base URL uses plain HTTP. OAuth flows should run over HTTPS; SonarSource logs this warning to prompt administrators to configure an HTTPS 'Server base URL'.

Source

Thrown at server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/LogOAuthWarning.java:56

    this.providers = providers;
  }

  /**
   * Used by default by the ioc container when no OAuth2IdentityProvider are present
   */
  @Autowired(required = false)
  public LogOAuthWarning(Server server) {
    this(server, new OAuth2IdentityProvider[0]);
  }

  @Override
  public void start() {
    if (providers.length == 0) {
      return;
    }
    String publicRootUrl = server.getPublicRootUrl();
    if (CI.startsWith(publicRootUrl, "http:")) {
      LoggerFactory.getLogger(getClass()).warn(
        "For security reasons, OAuth authentication should use HTTPS. You should set the property 'Administration > Configuration > Server base URL' to an HTTPS URL.");
    }
  }

  @Override
  public void stop() {
    // nothing to do
  }
}

View on GitHub (pinned to 184c821202)

Solutions

Set sonar.core.serverBaseURL (Administration > Configuration > Server base URL) to an https:// URL.
Put a TLS-terminating reverse proxy (nginx/traefik) in front of SonarQube and use its HTTPS URL as the base URL.
If HTTP is intentionally used in an isolated test env, ignore the warning or remove OAuth providers.

Example fix

// before (sonar.properties)
sonar.core.serverBaseURL=http://sonar.example.com
// after
sonar.core.serverBaseURL=https://sonar.example.com

Defensive patterns

Strategy: validation

Validate before calling

// before enabling OAuth, verify base URL is HTTPS
String baseUrl = settings.getValue(CoreProperties.SERVER_BASE_URL);
if (baseUrl != null && baseUrl.startsWith("http:")) {
  throw new IllegalStateException("Server base URL must be HTTPS for OAuth");
}

Prevention

Configure sonar.core.serverBaseURL with an https:// URL before enabling OAuth/SAML providers
Terminate TLS at a reverse proxy and redirect all HTTP to HTTPS
Re-check base URL after infrastructure or domain changes

When it happens

Trigger: start() runs when at least one OAuth provider (GitHub/GitLab/Bitbucket/Azure AD etc.) is configured (providers.length > 0) and server.getPublicRootUrl() starts with "http:" (checked with CI.startsWith), producing the warn log.

Common situations: Testing SonarQube behind plain HTTP before adding TLS; sonar.server.baseURL (sonar.core.serverBaseURL) misconfigured to an http:// address while SAML/OAuth login is enabled.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/645db18b37cceec6. Report an issue: GitHub.