{"record":{"id":"46049592438e6d47","repo":"apache/druid","slug":"basic-authentication-credentials-are-configured-bu","errorCode":null,"errorMessage":"Basic authentication credentials are configured but TLS is not enabled. This would transmit credentials in cleartext over the network. Either configure TLS (connection.sslClientConfig.trustStorePath) or explicitly allow insecure transmission by setting auth.allowBasicAuthOverHttp=true (only use this for sidecar TLS termination scenarios).","messagePattern":"Basic authentication credentials are configured but TLS is not enabled\\. This would transmit credentials in cleartext over the network\\. Either configure TLS \\(connection\\.sslClientConfig\\.trustStorePath\\) or explicitly allow insecure transmission by setting auth\\.allowBasicAuthOverHttp=true \\(only use this for sidecar TLS termination scenarios\\)\\.","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java","lineNumber":71,"sourceCode":"\n  private ConsulClients()\n  {\n  }\n\n  static ConsulClient create(ConsulDiscoveryConfig config)\n  {\n    ConsulDiscoveryConfig.ConnectionConfig connection = config.getConnection();\n    ConsulDiscoveryConfig.AuthConfig auth = config.getAuth();\n\n    ConsulSSLConfig sslConfig = connection.getSslClientConfig();\n    String basicUser = auth.getBasicAuthUser();\n    String basicPass = auth.getBasicAuthPassword();\n    boolean tlsConfigured = sslConfig != null && sslConfig.getTrustStorePath() != null;\n\n    // Validate basic auth over HTTP security requirements\n    if (basicUser != null && basicPass != null && !tlsConfigured) {\n      if (!auth.getAllowBasicAuthOverHttp()) {\n        throw new IllegalStateException(\n            \"Basic authentication credentials are configured but TLS is not enabled. \" +\n            \"This would transmit credentials in cleartext over the network. \" +\n            \"Either configure TLS (connection.sslClientConfig.trustStorePath) or explicitly allow \" +\n            \"insecure transmission by setting auth.allowBasicAuthOverHttp=true \" +\n            \"(only use this for sidecar TLS termination scenarios).\"\n        );\n      }\n      LOGGER.warn(\n          \"Using Basic Auth to Consul over plain HTTP (host: %s, port: %d) with allowBasicAuthOverHttp=true. \" +\n          \"Credentials will be transmitted in cleartext. \" +\n          \"Only use this configuration with sidecar TLS termination or in secure network environments.\",\n          connection.getHost(),\n          connection.getPort()\n      );\n    }\n\n    if (tlsConfigured) {\n      try {","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java#L53-L89","documentation":"Error \"Basic authentication credentials are configured but TLS is not enabled. This would transmit credentials in cleartext over the network. Either configure TLS (connection.sslClientConfig.trustStorePath) or explicitly allow insecure transmission by setting auth.allowBasicAuthOverHttp=true (only use this for sidecar TLS termination scenarios).\" thrown in apache/druid.","triggerScenarios":"Thrown at extensions-contrib/consul-extensions/src/main/java/org/apache/druid/consul/discovery/ConsulClients.java:71 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure TLS via connection.sslClientConfig (e.g. trustStorePath) so basic-auth credentials are encrypted in transit.","If TLS is terminated by a sidecar in front of Consul, explicitly set auth.allowBasicAuthOverHttp=true.","Remove basicAuthUser/basicAuthPassword if credentials are not needed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}