Setting authentication cookie over non-HTTPS connection…

Error message

Setting authentication cookie over non-HTTPS connection. This is not recommended for production.

What it means

Pac4jSessionStore.set() writes the authenticated user's profile into a cookie. When the request context is not HTTPS (isHttpsOrSecure() returns false), it logs this warning to flag that the authentication cookie is being issued over an insecure connection. The secure flag is still always set on the cookie, which means browsers will NOT send it back over plain HTTP — potentially breaking the session on subsequent requests.

Solutions

Serve Druid over HTTPS, or configure your proxy to terminate TLS correctly and set X-Forwarded-Proto=https so the request is seen as secure.
For local testing only, accept the warning or use https://localhost with a self-signed certificate.
Verify Druid/proxy configuration that restores the original scheme (e.g. RemoteIpValve/proxy settings) so isHttpsOrSecure() returns true.
Confirm clients can complete login after the change; with secure cookies over HTTP, cookies would silently be dropped by the browser.

Example fix

// before
# nginx proxy_pass http://druid; // no forwarded proto -> scheme=http -> warning
// after
proxy_set_header X-Forwarded-Proto https;
proxy_pass http://druid;

Defensive patterns

Strategy: validation

Validate before calling

// guard before login flows
if (!request.isSecure() && !"https".equals(request.getHeader("X-Forwarded-Proto"))) {
  LOG.warn("login attempted over non-HTTPS; auth cookie will not round-trip");
}

Prevention

Always front Druid with TLS in production.
Set X-Forwarded-Proto at the TLS-terminating proxy.
Test login over HTTP in staging to catch scheme-detection gaps.
Remember secure cookies are dropped by browsers over http://.

When it happens

Trigger: A user accesses Druid over http:// (or through a TLS-terminating proxy where the forwarded request scheme is not marked secure) while pac4j session-store cookie set is invoked; any login flow over plain HTTP.

Common situations: Local development or test environments using http://localhost; production setups behind a load balancer that terminates TLS but does not set X-Forwarded-Proto, so the servlet sees http; misconfigured reverse proxy.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/ae9330830456d739. Report an issue: GitHub.

Appendix: source

Thrown at extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java:129

      cookie = new Cookie(PAC4J_SESSION_PREFIX + key, "");
      cookie.setMaxAge(0);
    } else {
      if (Pac4jConstants.USER_PROFILES.equals(key)) {
        /* trim the profile object */
        profile = clearUserProfile(value);
      }

      String encryptedValue = compressEncryptBase64(profile);
      cookie = new Cookie(PAC4J_SESSION_PREFIX + key, encryptedValue);
      cookie.setMaxAge(900); // 15 minutes
    }

    cookie.setHttpOnly(true);
    // Always set secure flag for authentication cookies to prevent transmission over HTTP
    // This ensures the cookie is only sent over HTTPS connections
    boolean isSecure = isHttpsOrSecure(context);
    if (!isSecure) {
      LOGGER.warn("Setting authentication cookie over non-HTTPS connection. This is not recommended for production.");
    }
    cookie.setSecure(true); // Always set secure flag for authentication cookies
    cookie.setPath("/");

    if (context instanceof JEEContext) {
      JEEContext jeeContext = (JEEContext) context;
      HttpServletResponse response = jeeContext.getNativeResponse();
      response.addCookie(cookie);
      // Only delegate to JEESessionStore if we have a JEEContext
      delegate.set(context, key, value);
    } else {
      // For non-JEE contexts (like test mocks), add cookie to response
      org.pac4j.core.context.Cookie pac4jCookie = new org.pac4j.core.context.Cookie(
              cookie.getName(), cookie.getValue()
      );
      pac4jCookie.setHttpOnly(cookie.isHttpOnly());
      pac4jCookie.setSecure(cookie.getSecure());
      pac4jCookie.setMaxAge(cookie.getMaxAge());

View on GitHub (pinned to 9b90983fd2)