SNOW-2231895: Add warning on using http in oauth (#2747)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: sfc-gh-turbaszek

DESCRIPTION.md

@@ -11,6 +11,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Ensured proper list conversion - the converter runs to_snowflake on all list elements.
   - Made the parameter `server_session_keep_alive` in `SnowflakeConnection` skip checking for pending async queries, providing faster connection close times especially when many async queries are executed.
   - Fix string representation of INTERVAL YEAR and INTERVAL MONTH types.
+  - Log a warning when using http protocol for OAuth urls.
 
 - v4.2.0(January 07,2026)
   - Added `SnowflakeCursor.stats` property to expose granular DML statistics (rows inserted, deleted, updated, and duplicates) for operations like CTAS where `rowcount` is insufficient.

src/snowflake/connector/auth/_oauth_base.py

@@ -428,6 +428,27 @@ def _create_token_request_headers(self) -> dict[str, str]:
             "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
         }
 
+    @staticmethod
+    def _log_if_http_in_use(url: str) -> None:
+        """Log a warning if the URL uses insecure HTTP protocol.
+
+        Args:
+            url: The URL to check for HTTP usage
+        """
+        try:
+            parsed_url = urllib.parse.urlparse(url)
+            if parsed_url.scheme == "http":
+                logger.warning(
+                    "OAuth URL uses insecure HTTP protocol: %s",
+                    SecretDetector.mask_secrets(url),
+                )
+        except Exception as e:
+            logger.warning(
+                "Cannot parse URL: %s. %s",
+                SecretDetector.mask_secrets(url),
+                e,
+            )
+
     @staticmethod
     def _resolve_proxy_url(
         connection: SnowflakeConnection, request_url: str

src/snowflake/connector/auth/oauth_code.py

@@ -79,6 +79,11 @@ def __init__(
             host,
             connection,
         )
+        # Warn if HTTP is used for OAuth URLs
+        if authentication_url:
+            self._log_if_http_in_use(authentication_url)
+        if token_request_url:
+            self._log_if_http_in_use(token_request_url)
 
         super().__init__(
             client_id=client_id,

src/snowflake/connector/auth/oauth_credentials.py

@@ -31,6 +31,9 @@ def __init__(
         **kwargs,
     ) -> None:
         self._validate_client_credentials_present(client_id, client_secret, connection)
+        # Warn if HTTP is used for OAuth token request URL
+        if token_request_url:
+            self._log_if_http_in_use(token_request_url)
         super().__init__(
             client_id=client_id,
             client_secret=client_secret,