[AMBARI-13278] Add security-related HTTP headers to keep Ambari up to date with best-practices

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.7.0
• Fix Version/s: 2.3.0, 2.0.3, 2.2.0
• Component/s: ambari-server
• Assignee: Robert Levas
• Reporter: Robert Levas
• Created: 30/Sep/15 16:51
• Updated: 01/Oct/15 21:31
• Resolved: 01/Oct/15 18:53

Description

Add security-related HTTP headers to keep Ambari up to date with best-practices.

• Strict-Transport-Security
• X-Frame-Options
• X-XSS-Protection

These headers should be configurable via the ambari.properties such that they may be turned on or off - and set to some custom value.

The default value for this headers should be as follows:

• Strict-Transport-Security: max-age=31536000
• X-Frame-Options: DENY
• X-XSS-Protection: 1; mode=block

Strict-Transport-Security should only be turned on if SSL is enabled.

The relevant Ambari properties should be:

• Strict-Transport-Security: http.strict-transport-security
• X-Frame-Options: http.x-frame-options
• X-XSS-Protection: http.x-xss-protection

By setting any of these to be empty, the header is to be turned off (or not set).

For example:

Sets Strict-Transport-Security to a custom value

http.strict-transport-security=max-age=31536000; includeSubDomains

Turns Strict-Transport-Security off

http.strict-transport-security=

Issue Links

• links to: ReviewBoard