Details
-
New Feature
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
None
-
None
-
Reviewed
Description
CSRF prevention for REST APIs can be provided through a common servlet filter. This filter would check for the existence of an expected (configurable) HTTP header - such as X-XSRF-Header.
The fact that CSRF attacks are entirely browser based means that the above approach can ensure that requests are coming from either: applications served by the same origin as the REST API or that there is explicit policy configuration that allows the setting of a header on XmlHttpRequest from another origin.
Attachments
Attachments
Issue Links
- is cloned by
-
HADOOP-13008 Add XFS Filter for UIs to Hadoop Common
- Resolved
- is related to
-
SPARK-15440 Add CSRF Filter for REST APIs to Spark
- Resolved
-
HADOOP-12758 Extend CSRF Filter with UserAgent Checks
- Resolved
- relates to
-
HDFS-9711 Integrate CSRF prevention filter in WebHDFS.
- Resolved