{"record":{"id":"645db18b37cceec6","repo":"SonarSource/sonarqube","slug":"for-security-reasons-oauth-authentication-should","errorCode":null,"errorMessage":"For security reasons, OAuth authentication should use HTTPS. You should set the property 'Administration > Configuration > Server base URL' to an HTTPS URL.","messagePattern":"For security reasons, OAuth authentication should use HTTPS\\. You should set the property 'Administration > Configuration > Server base URL' to an HTTPS URL\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/LogOAuthWarning.java","lineNumber":56,"sourceCode":"    this.providers = providers;\n  }\n\n  /**\n   * Used by default by the ioc container when no OAuth2IdentityProvider are present\n   */\n  @Autowired(required = false)\n  public LogOAuthWarning(Server server) {\n    this(server, new OAuth2IdentityProvider[0]);\n  }\n\n  @Override\n  public void start() {\n    if (providers.length == 0) {\n      return;\n    }\n    String publicRootUrl = server.getPublicRootUrl();\n    if (CI.startsWith(publicRootUrl, \"http:\")) {\n      LoggerFactory.getLogger(getClass()).warn(\n        \"For security reasons, OAuth authentication should use HTTPS. You should set the property 'Administration > Configuration > Server base URL' to an HTTPS URL.\");\n    }\n  }\n\n  @Override\n  public void stop() {\n    // nothing to do\n  }\n}\n","sourceCodeStart":38,"sourceCodeEnd":66,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/LogOAuthWarning.java#L38-L66","documentation":"LogOAuthWarning warns at startup when OAuth authentication providers are configured but the server base URL uses plain HTTP. OAuth flows should run over HTTPS; SonarSource logs this warning to prompt administrators to configure an HTTPS 'Server base URL'.","triggerScenarios":"start() runs when at least one OAuth provider (GitHub/GitLab/Bitbucket/Azure AD etc.) is configured (providers.length > 0) and server.getPublicRootUrl() starts with \"http:\" (checked with CI.startsWith), producing the warn log.","commonSituations":"Testing SonarQube behind plain HTTP before adding TLS; sonar.server.baseURL (sonar.core.serverBaseURL) misconfigured to an http:// address while SAML/OAuth login is enabled.","solutions":["Set sonar.core.serverBaseURL (Administration > Configuration > Server base URL) to an https:// URL.","Put a TLS-terminating reverse proxy (nginx/traefik) in front of SonarQube and use its HTTPS URL as the base URL.","If HTTP is intentionally used in an isolated test env, ignore the warning or remove OAuth providers."],"exampleFix":"// before (sonar.properties)\nsonar.core.serverBaseURL=http://sonar.example.com\n// after\nsonar.core.serverBaseURL=https://sonar.example.com","handlingStrategy":"validation","validationCode":"// before enabling OAuth, verify base URL is HTTPS\nString baseUrl = settings.getValue(CoreProperties.SERVER_BASE_URL);\nif (baseUrl != null && baseUrl.startsWith(\"http:\")) {\n  throw new IllegalStateException(\"Server base URL must be HTTPS for OAuth\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure sonar.core.serverBaseURL with an https:// URL before enabling OAuth/SAML providers","Terminate TLS at a reverse proxy and redirect all HTTP to HTTPS","Re-check base URL after infrastructure or domain changes"],"tags":["sonarqube","oauth","https","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}