{"record":{"id":"657a74c76f04d3fa","repo":"prestodb/presto","slug":"authentication-using-an-access-token-requires-ssl","errorCode":null,"errorMessage":"Authentication using an access token requires SSL to be enabled","messagePattern":"Authentication using an access token requires SSL to be enabled","errorType":"validation","errorClass":"SQLException","httpStatus":null,"severity":"error","filePath":"presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java","lineNumber":300,"sourceCode":"                }\n                setupKerberos(\n                        builder,\n                        KERBEROS_REMOTE_SERVICE_NAME.getRequiredValue(properties),\n                        KERBEROS_USE_CANONICAL_HOSTNAME.getRequiredValue(properties),\n                        KERBEROS_PRINCIPAL.getValue(properties),\n                        KERBEROS_CONFIG_PATH.getValue(properties),\n                        KERBEROS_KEYTAB_PATH.getValue(properties),\n                        Optional.ofNullable(KERBEROS_CREDENTIAL_CACHE_PATH.getValue(properties)\n                                .orElseGet(() -> defaultCredentialCachePath().map(File::new).orElse(null))));\n            }\n\n            Map<String, String> extraCredentials = EXTRA_CREDENTIALS.getValue(properties).orElse(ImmutableMap.of());\n            Optional.ofNullable(extraCredentials.get(GCS_CREDENTIALS_PATH_KEY))\n                    .ifPresent(credentialPath -> OkHttpUtil.setupGCSOauth(builder, credentialPath, Optional.ofNullable(extraCredentials.get(GCS_OAUTH_SCOPES_KEY))));\n\n            if (ACCESS_TOKEN.getValue(properties).isPresent()) {\n                if (!useSecureConnection) {\n                    throw new SQLException(\"Authentication using an access token requires SSL to be enabled\");\n                }\n                builder.addInterceptor(tokenAuth(ACCESS_TOKEN.getValue(properties).get()));\n            }\n\n            if (EXTERNAL_AUTHENTICATION.getValue(properties).orElse(false)) {\n                if (!useSecureConnection) {\n                    throw new SQLException(\"Authentication using external authorization requires SSL to be enabled\");\n                }\n\n                // create HTTP client that shares the same settings, but without the external authenticator\n                TokenPoller poller = new HttpTokenPoller(builder.build());\n\n                Duration timeout = EXTERNAL_AUTHENTICATION_TIMEOUT.getValue(properties)\n                        .map(value -> Duration.ofMillis(value.toMillis()))\n                        .orElse(Duration.ofMinutes(2));\n\n                KnownTokenCache knownTokenCache = EXTERNAL_AUTHENTICATION_TOKEN_CACHE.getValue(properties).get();\n                Optional<RedirectHandler> configuredHandler = EXTERNAL_AUTHENTICATION_REDIRECT_HANDLERS.getValue(properties)","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java#L282-L318","documentation":"PrestoDriverUri.setupClient validates authentication settings: if an access token is supplied in the JDBC properties but the URL does not use HTTPS, token-based authentication would send credentials in the clear, so this SQLException is thrown to force SSL usage.","triggerScenarios":"Thrown at presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java:300 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an https:// JDBC URL so SSL is enabled for token authentication","Remove the access token property if anonymous/no-auth connectivity was intended"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}