[HADOOP-10880] Move HTTP delegation tokens out of URL querystring to a header

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 2.4.1
• Fix Version/s: 2.6.0
• Component/s: security
• Target Version/s: 2.6.0
• Hadoop Flags: Reviewed
• Assignee: Alejandro Abdelnur
• Reporter: Alejandro Abdelnur
• Created: 22/Jul/14 21:03
• Updated: 01/Dec/14 03:09
• Resolved: 28/Aug/14 21:49

Description

Following up on a discussion in HADOOP-10799.

Because URLs are often logged, delegation tokens may end up in LOG files while they are still valid.

We should move the tokens to a header.

We should still support tokens in the querystring for backwards compatibility.

Issue Links

• is blocked by: HADOOP-10771 Refactor HTTP delegation support out of httpfs to common
• is blocked by: HADOOP-10835 Implement HTTP proxyuser support in HTTP authentication client/server libraries