[HADOOP-10379] Protect authentication cookies with the HttpOnly and Secure flags

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.4.0
• Hadoop Flags: Reviewed
• Assignee: Haohui Mai
• Reporter: Haohui Mai
• Created: 03/Mar/14 22:36
• Updated: 17/Jun/14 03:52
• Resolved: 05/Mar/14 01:57

Description

Browser vendors have adopted proposals to enhance the security of HTTP cookies. For example, the server can mark a cookie as Secure so that it will not be transfer via plain-text HTTP protocol, and the server can mark a cookie as HttpOnly to prohibit the JavaScript to access that cookie.

This jira proposes to adopt these flags in Hadoop to protect the HTTP cookie used for authentication purposes.

Issue Links

• breaks: HDFS-6548 AuthenticationToken will be ignored if the cookie value contains '@'