[HADOOP-12691] Add CSRF Filter for REST APIs to Hadoop Common

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: security
• Hadoop Flags: Reviewed
• Assignee: Larry McCay
• Reporter: Larry McCay
• Created: 06/Jan/16 20:07
• Updated: 30/Aug/16 01:20
• Resolved: 14/Jan/16 20:01

Description

CSRF prevention for REST APIs can be provided through a common servlet filter. This filter would check for the existence of an expected (configurable) HTTP header - such as X-XSRF-Header.

The fact that CSRF attacks are entirely browser based means that the above approach can ensure that requests are coming from either: applications served by the same origin as the REST API or that there is explicit policy configuration that allows the setting of a header on XmlHttpRequest from another origin.

Issue Links

• is cloned by: HADOOP-13008 Add XFS Filter for UIs to Hadoop Common
• is related to: SPARK-15440 Add CSRF Filter for REST APIs to Spark
• is related to: HADOOP-12758 Extend CSRF Filter with UserAgent Checks
• relates to: HDFS-9711 Integrate CSRF prevention filter in WebHDFS.