{"record":{"id":"c07c065548ee310c","repo":"prestodb/presto","slug":"authentication-using-username-password-requires-ss","errorCode":null,"errorMessage":"Authentication using username/password requires SSL to be enabled","messagePattern":"Authentication using username/password requires SSL to be enabled","errorType":"validation","errorClass":"SQLException","httpStatus":null,"severity":"critical","filePath":"presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java","lineNumber":263,"sourceCode":"        return FOLLOW_REDIRECTS.getValue(properties).orElse(true);\n    }\n\n    public void setupClient(OkHttpClient.Builder builder)\n            throws SQLException\n    {\n        try {\n            setupCookieJar(builder);\n            setupSocksProxy(builder, SOCKS_PROXY.getValue(properties));\n            setupHttpProxy(builder, HTTP_PROXY.getValue(properties));\n\n            // add user specified protocols to okhttp3 client if specified\n            getProtocols().ifPresent(builder::protocols);\n\n            // TODO: fix Tempto to allow empty passwords\n            String password = PASSWORD.getValue(properties).orElse(\"\");\n            if (!password.isEmpty() && !password.equals(\"***empty***\")) {\n                if (!useSecureConnection) {\n                    throw new SQLException(\"Authentication using username/password requires SSL to be enabled\");\n                }\n                builder.addInterceptor(basicAuth(getUser(), password));\n            }\n\n            if (useSecureConnection) {\n                setupSsl(\n                        builder,\n                        SSL_KEY_STORE_PATH.getValue(properties),\n                        SSL_KEY_STORE_PASSWORD.getValue(properties),\n                        SSL_KEY_STORE_TYPE.getValue(properties),\n                        SSL_TRUST_STORE_PATH.getValue(properties),\n                        SSL_TRUST_STORE_PASSWORD.getValue(properties),\n                        SSL_TRUST_STORE_TYPE.getValue(properties));\n            }\n\n            if (KERBEROS_REMOTE_SERVICE_NAME.getValue(properties).isPresent()) {\n                if (!useSecureConnection) {\n                    throw new SQLException(\"Authentication using Kerberos requires SSL to be enabled\");","sourceCodeStart":245,"sourceCodeEnd":281,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java#L245-L281","documentation":"setupClient() enforces that when a non-empty password is configured for basic authentication, the connection must be secure (HTTPS). It throws SQLException('Authentication using username/password requires SSL to be enabled') because sending credentials over plain HTTP would expose them. The password comes from the 'password' property; '***empty***' is treated as empty for compatibility with Tempto tests.","triggerScenarios":"Connecting with jdbc:presto://... (no https) while supplying both user and password properties, e.g. url 'jdbc:presto://host:8080?user=bob&password=secret'.","commonSituations":"Migrating from unauthenticated clusters to LDAP/password-authenticated coordinators, forgetting to switch URL scheme to https, disabling SSL for local testing while still setting a password.","solutions":["Change the JDBC URL scheme to https (jdbc:presto://host:8443) so useSecureConnection is true","Add proper SSL setup: SSLTrustStorePath/SSLTrustStorePassword/SSLTrustStoreType properties or keystore config","For test environments without auth, remove the password property instead of sending credentials over http","If TLS is terminated elsewhere, use an https endpoint that still encrypts the credential-bearing request"],"exampleFix":"// before\nString url = \"jdbc:presto://coordinator:8080/catalog/schema?user=alice&password=secret\";\n// after\nString url = \"jdbc:presto://coordinator:8443/catalog/schema?user=alice&password=secret&SSLTrustStorePath=/etc/truststore.jks&SSLTrustStorePassword=changeit\";","handlingStrategy":"validation","validationCode":"String url = jdbcUrl;\nString password = props.getProperty(\"password\");\nif (password != null && !password.isEmpty() && !password.equals(\"***empty***\") && !url.startsWith(\"jdbc:presto://https\") && !url.contains(\":8443\") && !props.containsKey(\"SSLTrustStorePath\") && url.contains(\"http://\")) {\n    throw new IllegalArgumentException(\"password set but connection is not SSL; use https URL\");\n}","typeGuard":null,"tryCatchPattern":"try { return DriverManager.getConnection(url, props); } catch (SQLException e) { if (e.getMessage().contains(\"username/password requires SSL\")) { throw new ConfigurationException(\"Enable https in JDBC URL or remove the password property\", e); } throw e; }","preventionTips":["Always use https URLs when sending passwords","Configure SSLTrustStorePath/Password/Type for self-signed coordinators","Never set password properties for plaintext local testing","Validate JDBC URL scheme against auth properties at config load time"],"tags":["jdbc","ssl","authentication","security","configuration"],"backgroundTag":"credentials-over-insecure-connection","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}