prestodb/presto · error · SQLException

Authentication using an access token requires SSL to be enab

Error message

Authentication using an access token requires SSL to be enabled

What it means

PrestoDriverUri.setupClient validates authentication settings: if an access token is supplied in the JDBC properties but the URL does not use HTTPS, token-based authentication would send credentials in the clear, so this SQLException is thrown to force SSL usage.

Source

Thrown at presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java:300

                }
                setupKerberos(
                        builder,
                        KERBEROS_REMOTE_SERVICE_NAME.getRequiredValue(properties),
                        KERBEROS_USE_CANONICAL_HOSTNAME.getRequiredValue(properties),
                        KERBEROS_PRINCIPAL.getValue(properties),
                        KERBEROS_CONFIG_PATH.getValue(properties),
                        KERBEROS_KEYTAB_PATH.getValue(properties),
                        Optional.ofNullable(KERBEROS_CREDENTIAL_CACHE_PATH.getValue(properties)
                                .orElseGet(() -> defaultCredentialCachePath().map(File::new).orElse(null))));
            }

            Map<String, String> extraCredentials = EXTRA_CREDENTIALS.getValue(properties).orElse(ImmutableMap.of());
            Optional.ofNullable(extraCredentials.get(GCS_CREDENTIALS_PATH_KEY))
                    .ifPresent(credentialPath -> OkHttpUtil.setupGCSOauth(builder, credentialPath, Optional.ofNullable(extraCredentials.get(GCS_OAUTH_SCOPES_KEY))));

            if (ACCESS_TOKEN.getValue(properties).isPresent()) {
                if (!useSecureConnection) {
                    throw new SQLException("Authentication using an access token requires SSL to be enabled");
                }
                builder.addInterceptor(tokenAuth(ACCESS_TOKEN.getValue(properties).get()));
            }

            if (EXTERNAL_AUTHENTICATION.getValue(properties).orElse(false)) {
                if (!useSecureConnection) {
                    throw new SQLException("Authentication using external authorization requires SSL to be enabled");
                }

                // create HTTP client that shares the same settings, but without the external authenticator
                TokenPoller poller = new HttpTokenPoller(builder.build());

                Duration timeout = EXTERNAL_AUTHENTICATION_TIMEOUT.getValue(properties)
                        .map(value -> Duration.ofMillis(value.toMillis()))
                        .orElse(Duration.ofMinutes(2));

                KnownTokenCache knownTokenCache = EXTERNAL_AUTHENTICATION_TOKEN_CACHE.getValue(properties).get();
                Optional<RedirectHandler> configuredHandler = EXTERNAL_AUTHENTICATION_REDIRECT_HANDLERS.getValue(properties)

View on GitHub (pinned to 55bb57d202)

Solutions

1. Use an https:// JDBC URL so SSL is enabled for token authentication
2. Remove the access token property if anonymous/no-auth connectivity was intended

When it happens

Trigger: Thrown at presto-jdbc/src/main/java/com/facebook/presto/jdbc/PrestoDriverUri.java:300 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.
• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/657a74c76f04d3fa. Report an issue: GitHub.