Skip to main content

HTTP server properties

HTTP server properties allow you to configure the HTTP server of Trino that handles Security including Secure internal communication, and serves the Web UI and the client API.

General​

http-server.process-forwarded​

Enable treating forwarded HTTPS requests over HTTP as secure. Requires the X-Forwarded headers to be set to HTTPS on forwarded requests. This is commonly performed by a load balancer that terminates HTTPS to HTTP. Set to true when using such a load balancer in front of Trino or Trino Gateway. Find more details in TLS and HTTPS.

HTTP and HTTPS​

http-server.http.port​

Specify the HTTP port for the HTTP server.

http-server.https.enabled​

Enable TLS and HTTPS.

http-server.https.port​

Specify the HTTPS port for the HTTP server.

http-server.https.included-cipher and http-server.https.excluded-cipher​

Optional configuration for ciphers to use TLS, find details in TLS and HTTPS.

http-server.https.keystore.path​

The location of the PEM or Java keystore file used to enable TLS and HTTPS.

http-server.https.keystore.key​

The password for the PEM or Java keystore.

http-server.https.truststore.path​

The location of the optional PEM or Java truststore file for additional certificate authorities. Find details in TLS and HTTPS.

http-server.https.truststore.key​

The password for the optional PEM or Java truststore.

http-server.https.keymanager.password​

Password for a key within a keystore, when a different password is configured for the specific key. Find details in TLS and HTTPS.

http-server.https.secure-random-algorithm​

Optional name of the algorithm to generate secure random values for internal communication.

http-server.https.ssl-session-timeout​

Time duration for a valid TLS client session.

http-server.https.ssl-session-cache-size​

Maximum number of SSL session cache entries.

http-server.https.ssl-context.refresh-time​

Time between reloading default certificates.

Authentication​

http-server.authentication.type​

Configures the ordered list of enabled authentication types.

All authentication requires secure connections using TLS and HTTPS or process forwarding enabled, and a configured shared secret.

http-server.authentication.allow-insecure-over-http​

Enable HTTP when any authentication is active. Defaults to true, but is automatically set to false with active authentication. Overriding the value to true can be useful for testing, but is not secure. More details in TLS and HTTPS.

http-server.authentication.certificate.*​

Configuration properties for Certificate authentication.

http-server.authentication.jwt.*​

Configuration properties for JWT authentication.

http-server.authentication.krb5.*​

Configuration properties for Kerberos authentication.

http-server.authentication.oauth2.*​

Configuration properties for OAuth 2.0 authentication.

http-server.authentication.password.*​

Configuration properties for the PASSWORD authentication types LDAP authentication, Password file authentication, and Salesforce authentication.

Logging​

http-server.log.*​

Configuration properties for Logging properties.

(props-internal-communication)

Internal communication​

The following properties are used for configuring the internal communication between all nodes of a Trino cluster.

internal-communication.shared-secret​

The string to use as secret that only the coordinators and workers in a specific cluster share and use to authenticate within the cluster. See Secure internal communication for details.

internal-communication.http2.enabled​

Enable use of the HTTP/2 protocol for internal communication for enhanced scalability compared to HTTP/1.1. Only turn this feature off if you encounter issues with HTTP/2 usage within the cluster in your deployment.

internal-communication.https.required​

Enable the use of SSL/TLS for all internal communication.