{"record":{"id":"3bee0f5b85484941","repo":"prestodb/presto","slug":"cannot-set-system-session-property-s-s","errorCode":null,"errorMessage":"Cannot set system session property %s%s","messagePattern":"Cannot set system session property (.+?)(.+?)","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":null,"severity":"error","filePath":"presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java","lineNumber":357,"sourceCode":"\n    public static void denyShowCurrentRoles(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show current roles from catalog %s\", catalogName));\n    }\n\n    public static void denyShowRoleGrants(String catalogName)\n    {\n        throw new AccessDeniedException(format(\"Cannot show role grants from catalog %s\", catalogName));\n    }\n\n    public static void denySetSystemSessionProperty(String propertyName)\n    {\n        denySetSystemSessionProperty(propertyName, null);\n    }\n\n    public static void denySetSystemSessionProperty(String propertyName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot set system session property %s%s\", propertyName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySetCatalogSessionProperty(String catalogName, String propertyName)\n    {\n        denySetCatalogSessionProperty(catalogName, propertyName, null);\n    }\n\n    public static void denySetCatalogSessionProperty(String catalogName, String propertyName, String extraInfo)\n    {\n        throw new AccessDeniedException(format(\"Cannot set catalog session property %s.%s%s\", catalogName, propertyName, formatExtraInfo(extraInfo)));\n    }\n\n    public static void denySetCatalogSessionProperty(String propertyName)\n    {\n        throw new AccessDeniedException(format(\"Cannot set catalog session property %s\", propertyName));\n    }\n\n    public static void denySelectColumns(String tableName, Collection<String> columnNames)","sourceCodeStart":339,"sourceCodeEnd":375,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-spi/src/main/java/com/facebook/presto/spi/security/AccessDeniedException.java#L339-L375","documentation":"Thrown by denySetSystemSessionProperty when a client attempts to SET a system (catalog-independent) session property and the access control denies it via checkCanSetSystemSessionProperty. Presto lets deployments lock down sensitive properties (e.g. query.max-memory, resource flags) so users cannot weaken limits. The message may carry extraInfo appended when a specific denial reason is supplied.","triggerScenarios":"Executing 'SET SESSION <system_property> = value' (or JDBC connection session properties) for a property listed as restricted in the system access control configuration.","commonSituations":"Clients pre-setting tuning properties in JDBC URLs against clusters with property whitelists; upgrading Presto where a property newly became restricted; scripts setting query.* properties the ops team has frozen.","solutions":["Remove or defer the restricted property from your session/JDBC configuration and use cluster defaults.","Ask the operator to allow the property in the system access control's allowed- (or blocked-) property list.","Check the exact property name; typos can cause fallback denial paths.","Use a session the policy permits (e.g. an admin) only if the change is genuinely authorized."],"exampleFix":"// before\njdbc:presto://coordinator:8080/hive/default?sessionProperties=query.max-run-time=1d\n// after: drop the restricted override and tune via cluster config\njdbc:presto://coordinator:8080/hive/default","handlingStrategy":"validation","validationCode":"// Maintain the deployment's blocked/allowed system property list client-side\nSet<String> restricted = loadRestrictedSystemProperties(); // from access-control config\nif (restricted.contains(propertyName)) {\n    throw new IllegalArgumentException(\"Property not settable here: \" + propertyName);\n}","typeGuard":null,"tryCatchPattern":"try {\n    stmt.execute(\"SET SESSION \" + prop + \" = \" + value);\n} catch (AccessDeniedException e) {\n    log.warn(\"System property {} blocked by access control; using cluster default\", prop);\n}","preventionTips":["Keep client session-property overrides minimal; tune server-side instead.","Diff your JDBC session properties against the cluster's restricted list on each upgrade.","Document which session properties are frozen by ops."],"tags":["security","session-properties","access-control","configuration"],"backgroundTag":"access-denied-authorization","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}