{"record":{"id":"ae9330830456d739","repo":"apache/druid","slug":"setting-authentication-cookie-over-non-https-conne","errorCode":null,"errorMessage":"Setting authentication cookie over non-HTTPS connection. This is not recommended for production.","messagePattern":"Setting authentication cookie over non-HTTPS connection\\. This is not recommended for production\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java","lineNumber":129,"sourceCode":"      cookie = new Cookie(PAC4J_SESSION_PREFIX + key, \"\");\n      cookie.setMaxAge(0);\n    } else {\n      if (Pac4jConstants.USER_PROFILES.equals(key)) {\n        /* trim the profile object */\n        profile = clearUserProfile(value);\n      }\n\n      String encryptedValue = compressEncryptBase64(profile);\n      cookie = new Cookie(PAC4J_SESSION_PREFIX + key, encryptedValue);\n      cookie.setMaxAge(900); // 15 minutes\n    }\n\n    cookie.setHttpOnly(true);\n    // Always set secure flag for authentication cookies to prevent transmission over HTTP\n    // This ensures the cookie is only sent over HTTPS connections\n    boolean isSecure = isHttpsOrSecure(context);\n    if (!isSecure) {\n      LOGGER.warn(\"Setting authentication cookie over non-HTTPS connection. This is not recommended for production.\");\n    }\n    cookie.setSecure(true); // Always set secure flag for authentication cookies\n    cookie.setPath(\"/\");\n\n    if (context instanceof JEEContext) {\n      JEEContext jeeContext = (JEEContext) context;\n      HttpServletResponse response = jeeContext.getNativeResponse();\n      response.addCookie(cookie);\n      // Only delegate to JEESessionStore if we have a JEEContext\n      delegate.set(context, key, value);\n    } else {\n      // For non-JEE contexts (like test mocks), add cookie to response\n      org.pac4j.core.context.Cookie pac4jCookie = new org.pac4j.core.context.Cookie(\n              cookie.getName(), cookie.getValue()\n      );\n      pac4jCookie.setHttpOnly(cookie.isHttpOnly());\n      pac4jCookie.setSecure(cookie.getSecure());\n      pac4jCookie.setMaxAge(cookie.getMaxAge());","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jSessionStore.java#L111-L147","documentation":"Pac4jSessionStore.set() writes the authenticated user's profile into a cookie. When the request context is not HTTPS (isHttpsOrSecure() returns false), it logs this warning to flag that the authentication cookie is being issued over an insecure connection. The secure flag is still always set on the cookie, which means browsers will NOT send it back over plain HTTP — potentially breaking the session on subsequent requests.","triggerScenarios":"A user accesses Druid over http:// (or through a TLS-terminating proxy where the forwarded request scheme is not marked secure) while pac4j session-store cookie set is invoked; any login flow over plain HTTP.","commonSituations":"Local development or test environments using http://localhost; production setups behind a load balancer that terminates TLS but does not set X-Forwarded-Proto, so the servlet sees http; misconfigured reverse proxy.","solutions":["Serve Druid over HTTPS, or configure your proxy to terminate TLS correctly and set X-Forwarded-Proto=https so the request is seen as secure.","For local testing only, accept the warning or use https://localhost with a self-signed certificate.","Verify Druid/proxy configuration that restores the original scheme (e.g. RemoteIpValve/proxy settings) so isHttpsOrSecure() returns true.","Confirm clients can complete login after the change; with secure cookies over HTTP, cookies would silently be dropped by the browser."],"exampleFix":"// before\n# nginx proxy_pass http://druid; // no forwarded proto -> scheme=http -> warning\n// after\nproxy_set_header X-Forwarded-Proto https;\nproxy_pass http://druid;","handlingStrategy":"validation","validationCode":"// guard before login flows\nif (!request.isSecure() && !\"https\".equals(request.getHeader(\"X-Forwarded-Proto\"))) {\n  LOG.warn(\"login attempted over non-HTTPS; auth cookie will not round-trip\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always front Druid with TLS in production.","Set X-Forwarded-Proto at the TLS-terminating proxy.","Test login over HTTP in staging to catch scheme-detection gaps.","Remember secure cookies are dropped by browsers over http://."],"tags":["security","https","cookie","tls","pac4j"],"backgroundTag":"insecure-connection","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}