apache/druid · warning

Using Basic Auth to Consul over plain HTTP

Error message

Using Basic Auth to Consul over plain HTTP (host: %s, port: %d) with allowBasicAuthOverHttp=true. Credentials will be transmitted in cleartext. Only use this configuration with sidecar TLS termination or in secure network environments.

What it means

This warning is emitted by ConsulClients.create when Basic Auth credentials are about to be sent to a Consul agent over unencrypted plain HTTP. Because Basic Auth transmits base64-encoded (not encrypted) credentials, any network observer can read them. The warning appears only when the user has explicitly set auth.allowBasicAuthOverHttp=true, acknowledging the risk.

Solutions

1. Configure TLS for the Consul connection instead (e.g. connection.sslClientConfig.trustStorePath) and disable allowBasicAuthOverHttp.
2. If using sidecar TLS termination, ensure the sidecar actually encrypts traffic beyond the local host and restrict the plaintext leg to localhost.
3. Remove Basic Auth credentials and use Consul ACL tokens over mTLS, or rely on network-level security (VPC, loopback only).

Example fix

// before
connection.setHost("consul.internal"); // plain HTTP
config.setAllowBasicAuthOverHttp(true);
// after
connection.setSslClientConfig(new SslClientConfig().setTrustStorePath("/path/to/truststore.jks"));
config.setAllowBasicAuthOverHttp(false);

if (connectionConfigUsesPlainHttp() && hasBasicAuthCredentials()) {
  if (!config.isAllowBasicAuthOverHttp()) {
    throw new IllegalArgumentException("Configure TLS or explicitly set auth.allowBasicAuthOverHttp=true");
  }
  LOG.warn("Basic Auth over plain HTTP — credentials in cleartext");
}

When it happens

Trigger: Configuring a Consul connection with a non-TLS (plain HTTP) host/port while Basic Auth credentials (username/password) are set and auth.allowBasicAuthOverHttp=true is explicitly enabled.

Common situations: Operators enabling the insecure flag to get past a startup failure, typically when using a sidecar proxy that performs TLS termination (the intended use) or, mistakenly, when talking to Consul directly over an untrusted network.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• Access-Check-Result
• <authResult.getErrorMessage()>
• authResult.getErrorMessage()
• authResult.getErrorMessage()
• authResult.getErrorMessage()

AI-assisted analysis of apache/druid@9b90983fd2 (2026-09-07). Data as JSON: /api/errors/1dfa49fe7509baa6. Report an issue: GitHub.

Appendix: source

Thrown at extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java:79

    ConsulDiscoveryConfig.AuthConfig auth = config.getAuth();

    ConsulSSLConfig sslConfig = connection.getSslClientConfig();
    String basicUser = auth.getBasicAuthUser();
    String basicPass = auth.getBasicAuthPassword();
    boolean tlsConfigured = sslConfig != null && sslConfig.getTrustStorePath() != null;

    // Validate basic auth over HTTP security requirements
    if (basicUser != null && basicPass != null && !tlsConfigured) {
      if (!auth.getAllowBasicAuthOverHttp()) {
        throw new IllegalStateException(
            "Basic authentication credentials are configured but TLS is not enabled. " +
            "This would transmit credentials in cleartext over the network. " +
            "Either configure TLS (connection.sslClientConfig.trustStorePath) or explicitly allow " +
            "insecure transmission by setting auth.allowBasicAuthOverHttp=true " +
            "(only use this for sidecar TLS termination scenarios)."
        );
      }
      LOGGER.warn(
          "Using Basic Auth to Consul over plain HTTP (host: %s, port: %d) with allowBasicAuthOverHttp=true. " +
          "Credentials will be transmitted in cleartext. " +
          "Only use this configuration with sidecar TLS termination or in secure network environments.",
          connection.getHost(),
          connection.getPort()
      );
    }

    if (tlsConfigured) {
      try {
        SSLContext sslContext = buildSslContext(sslConfig);
        HttpClient httpClient = createHttpClientWithOptionalBasicAuth(sslContext, basicUser, basicPass, connection, sslConfig);

        String httpsHost = "https://" + connection.getHost();

        ConsulRawClient rawClient = new ConsulRawClient(httpsHost, connection.getPort(), httpClient);
        LOGGER.info("Created Consul client with HTTPS to %s:%d", connection.getHost(), connection.getPort());
        return new ConsulClient(rawClient);

View on GitHub (pinned to 9b90983fd2)