{"record":{"id":"ed22121b144f9329","repo":"GoogleContainerTools/jib","slug":"authentication-over-http-is-enabled-it-is-strongl","errorCode":null,"errorMessage":"Authentication over HTTP is enabled. It is strongly recommended that you do not enable this on a public network!","messagePattern":"Authentication over HTTP is enabled\\. It is strongly recommended that you do not enable this on a public network!","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"jib-plugins-common/src/main/java/com/google/cloud/tools/jib/plugins/common/PluginConfigurationProcessor.java","lineNumber":483,"sourceCode":"\n  @VisibleForTesting\n  static JibContainerBuilder processCommonConfiguration(\n      RawConfiguration rawConfiguration,\n      InferredAuthProvider inferredAuthProvider,\n      ProjectProperties projectProperties,\n      Containerizer containerizer)\n      throws InvalidImageReferenceException, MainClassInferenceException, InvalidAppRootException,\n          IOException, InvalidWorkingDirectoryException, InvalidPlatformException,\n          InvalidContainerVolumeException, IncompatibleBaseImageJavaVersionException,\n          NumberFormatException, InvalidContainerizingModeException,\n          InvalidFilesModificationTimeException, InvalidCreationTimeException,\n          ExtraDirectoryNotFoundException {\n    JibSystemProperties.checkHttpTimeoutProperty();\n    JibSystemProperties.checkProxyPortProperty();\n\n    if (JibSystemProperties.sendCredentialsOverHttp()) {\n      projectProperties.log(\n          LogEvent.warn(\n              \"Authentication over HTTP is enabled. It is strongly recommended that you do not \"\n                  + \"enable this on a public network!\"));\n    }\n\n    configureContainerizer(containerizer, rawConfiguration, projectProperties);\n\n    return processCommonConfiguration(rawConfiguration, inferredAuthProvider, projectProperties);\n  }\n\n  /**\n   * Returns a {@link JavaContainerBuilder} with the correctly parsed base image configuration.\n   *\n   * @param rawConfiguration contains the base image configuration\n   * @param projectProperties used for providing additional information\n   * @param inferredAuthProvider provides inferred auths for registry images\n   * @return a new {@link JavaContainerBuilder} with the configured base image\n   * @throws IncompatibleBaseImageJavaVersionException when the Java version in the base image is\n   *     incompatible with the Java version of the application to be containerized","sourceCodeStart":465,"sourceCodeEnd":501,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-plugins-common/src/main/java/com/google/cloud/tools/jib/plugins/common/PluginConfigurationProcessor.java#L465-L501","documentation":"Jib warns when the sendCredentialsOverHttp system property is enabled, causing registry credentials to be sent over an unencrypted HTTP connection. This risks credential interception, so the library logs a strong security warning rather than silently proceeding.","triggerScenarios":"Running Jib with -DsendCredentialsOverHttp=true while the target registry is reached over an http:// registry URL or plain-HTTP endpoint.","commonSituations":"Pushing to an insecure internal registry (e.g. localhost:5000 or an HTTP-only private registry) without TLS; misconfigured registry URL using http:// instead of https://.","solutions":["Remove the -DsendCredentialsOverHttp=true flag and use an HTTPS registry endpoint","Enable TLS on the private registry (e.g. behind a reverse proxy with a valid certificate)","If the registry must stay HTTP, restrict it to a trusted/isolated network or localhost only","Use registry-specific insecure-registry configuration of the container runtime instead of sending real credentials over HTTP"],"exampleFix":"// before\nmvn jib:build -Djib.to.image=http://registry:5000/myapp -DsendCredentialsOverHttp=true\n// after\nmvn jib:build -Djib.to.image=registry:5000/myapp  // registry served over HTTPS","handlingStrategy":"validation","validationCode":"if (Boolean.getBoolean(\"sendCredentialsOverHttp\")) {\n  System.out.println(\"WARNING: credentials will be sent over plain HTTP\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  buildImage();\n} catch (RegistryUnauthorizedException e) {\n  // do NOT 'fix' by enabling sendCredentialsOverHttp; fix TLS/auth instead\n  throw new IllegalStateException(\"Configure HTTPS registry and correct credentials\", e);\n}","preventionTips":["Never enable sendCredentialsOverHttp in CI or on public networks","Serve all registries over HTTPS with valid certificates","Restrict HTTP-only registries to localhost or isolated networks"],"tags":["security","http","credentials","registry"],"backgroundTag":"missing-credentials","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}