[HADOOP-13008] Add XFS Filter for UIs to Hadoop Common

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Component/s: security
• Hadoop Flags: Reviewed
• Assignee: Larry McCay
• Reporter: Larry McCay
• Created: 08/Apr/16 22:03
• Updated: 30/Aug/16 01:16
• Resolved: 11/May/16 18:16

Description

Cross Frame Scripting (XFS) prevention for UIs can be provided through a common servlet filter. This filter will set the X-Frame-Options HTTP header to DENY unless configured to another valid setting.

There are a number of UIs that could just add this to their filters as well as the Yarn webapp proxy which could add it for all it's proxied UIs - if appropriate.

Issue Links

• is a clone of: HADOOP-12691 Add CSRF Filter for REST APIs to Hadoop Common
• is related to: HADOOP-12234 Web UI Framable Page
• is related to: HDFS-10579 HDFS web interfaces lack configs for X-FRAME-OPTIONS protection
• relates to: HADOOP-13556 Change Configuration.getPropsWithPrefix to use getProps instead of iterator
• supercedes: HADOOP-12234 Web UI Framable Page