{"record":{"id":"1dfa49fe7509baa6","repo":"apache/druid","slug":"using-basic-auth-to-consul-over-plain-http-host","errorCode":null,"errorMessage":"Using Basic Auth to Consul over plain HTTP (host: %s, port: %d) with allowBasicAuthOverHttp=true. Credentials will be transmitted in cleartext. Only use this configuration with sidecar TLS termination or in secure network environments.","messagePattern":"Using Basic Auth to Consul over plain HTTP \\(host: (.+?), port: (.+?)\\) with allowBasicAuthOverHttp=true\\. Credentials will be transmitted in cleartext\\. Only use this configuration with sidecar TLS termination or in secure network environments\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java","lineNumber":79,"sourceCode":"    ConsulDiscoveryConfig.AuthConfig auth = config.getAuth();\n\n    ConsulSSLConfig sslConfig = connection.getSslClientConfig();\n    String basicUser = auth.getBasicAuthUser();\n    String basicPass = auth.getBasicAuthPassword();\n    boolean tlsConfigured = sslConfig != null && sslConfig.getTrustStorePath() != null;\n\n    // Validate basic auth over HTTP security requirements\n    if (basicUser != null && basicPass != null && !tlsConfigured) {\n      if (!auth.getAllowBasicAuthOverHttp()) {\n        throw new IllegalStateException(\n            \"Basic authentication credentials are configured but TLS is not enabled. \" +\n            \"This would transmit credentials in cleartext over the network. \" +\n            \"Either configure TLS (connection.sslClientConfig.trustStorePath) or explicitly allow \" +\n            \"insecure transmission by setting auth.allowBasicAuthOverHttp=true \" +\n            \"(only use this for sidecar TLS termination scenarios).\"\n        );\n      }\n      LOGGER.warn(\n          \"Using Basic Auth to Consul over plain HTTP (host: %s, port: %d) with allowBasicAuthOverHttp=true. \" +\n          \"Credentials will be transmitted in cleartext. \" +\n          \"Only use this configuration with sidecar TLS termination or in secure network environments.\",\n          connection.getHost(),\n          connection.getPort()\n      );\n    }\n\n    if (tlsConfigured) {\n      try {\n        SSLContext sslContext = buildSslContext(sslConfig);\n        HttpClient httpClient = createHttpClientWithOptionalBasicAuth(sslContext, basicUser, basicPass, connection, sslConfig);\n\n        String httpsHost = \"https://\" + connection.getHost();\n\n        ConsulRawClient rawClient = new ConsulRawClient(httpsHost, connection.getPort(), httpClient);\n        LOGGER.info(\"Created Consul client with HTTPS to %s:%d\", connection.getHost(), connection.getPort());\n        return new ConsulClient(rawClient);","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java#L61-L97","documentation":"This warning is emitted by ConsulClients.create when Basic Auth credentials are about to be sent to a Consul agent over unencrypted plain HTTP. Because Basic Auth transmits base64-encoded (not encrypted) credentials, any network observer can read them. The warning appears only when the user has explicitly set auth.allowBasicAuthOverHttp=true, acknowledging the risk.","triggerScenarios":"Configuring a Consul connection with a non-TLS (plain HTTP) host/port while Basic Auth credentials (username/password) are set and auth.allowBasicAuthOverHttp=true is explicitly enabled.","commonSituations":"Operators enabling the insecure flag to get past a startup failure, typically when using a sidecar proxy that performs TLS termination (the intended use) or, mistakenly, when talking to Consul directly over an untrusted network.","solutions":["Configure TLS for the Consul connection instead (e.g. connection.sslClientConfig.trustStorePath) and disable allowBasicAuthOverHttp.","If using sidecar TLS termination, ensure the sidecar actually encrypts traffic beyond the local host and restrict the plaintext leg to localhost.","Remove Basic Auth credentials and use Consul ACL tokens over mTLS, or rely on network-level security (VPC, loopback only)."],"exampleFix":"// before\nconnection.setHost(\"consul.internal\"); // plain HTTP\nconfig.setAllowBasicAuthOverHttp(true);\n// after\nconnection.setSslClientConfig(new SslClientConfig().setTrustStorePath(\"/path/to/truststore.jks\"));\nconfig.setAllowBasicAuthOverHttp(false);","handlingStrategy":"validation","validationCode":"if (connectionConfigUsesPlainHttp() && hasBasicAuthCredentials()) {\n  if (!config.isAllowBasicAuthOverHttp()) {\n    throw new IllegalArgumentException(\"Configure TLS or explicitly set auth.allowBasicAuthOverHttp=true\");\n  }\n  LOG.warn(\"Basic Auth over plain HTTP — credentials in cleartext\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Prefer TLS-secured Consul connections by default","Restrict allowBasicAuthOverHttp=true to sidecar TLS-termination setups","Keep the plaintext leg on localhost only","Never use Basic Auth over untrusted networks"],"tags":["security","consul","basic-auth","plaintext-credentials"],"backgroundTag":"insecure-credentials-transmission","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}