Details
-
Bug
-
Status: Open
-
Critical
-
Resolution: Unresolved
-
1.1.0
-
None
-
None
Description
Problem Description:
Visiting Ranger Admin UI in any browser (Firefox / Chrome) sets the HTTP Strict Transport Security (HSTS) header for the host where Ranger is running. Any subsequent request to other service on the same host (e.g. YARN RM UI etc.) over HTTP would get redirected to HTTPS because of this header and due to change in browser behavior recently: Firefox and Chrome.
Ideally, these headers should be configurable, so that admin can set them as per requirement. Like the way Knox expose this via configuration, I recently reported similar in Knox via KNOX-1434
Impact:
All the non-SSL requests to other services get redirected automatically to HTTPS and would result in SSL errors like: SSL_ERROR_RX_RECORD_TOO_LONG or some other error.
Expected Behavior:
1. Unless HSTS is specifically enabled for Ranger Admin UI, it should not set HSTS header. Therefore, there should be a configurable option to enable/disable HSTS.
2. HSTS should be disabled by default for Ranger Admin.
Steps to reproduce:
1. Install & configure Ranger with SSL and a trusted CA (no self-signed)
2. Also configure few other services like RM, Oozie on the same Ranger Admin host
3. Once Ranger is up, visit Ranger Admin UI
4. Now, in the same browser session, visit any non-SSL service running on the same Ranger host (like RM UI, Oozie UI).
5. Browser will redirect this HTTP request to HTTPS.
6. If one can carefully clear the HSTS header in browser, then redirection will stop until the next time one visits Ranger Admin UI again.
Workaround:
Currently the workaround is to open Ranger Admin UI in a separate browser OR move Ranger Admin service to a host where other UI services are not installed.