[HADOOP-15457] Add Security-Related HTTP Response Header in WEBUIs.

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.2.0
• Labels: security
• Hadoop Flags: Reviewed
• Assignee: Kanwaljeet Sachdev
• Reporter: Kanwaljeet Sachdev
• Due: 07/May/18
• Created: 23/Apr/18 16:28
• Updated: 13/Mar/24 11:55
• Resolved: 23/May/18 17:24

Description

As of today, YARN web-ui lacks certain security related http response headers. We are planning to add few default ones and also add support for headers to be able to get added via xml config. Planning to make the below two as default.

• X-XSS-Protection: 1; mode=block
• X-Content-Type-Options: nosniff

 

Support for headers via config properties in core-site.xml will be along the below lines

<property>
    <name>hadoop.http.header.Strict-Transport-Security</name>
    <value>valHSTSFromXML</value>
</property>

In the above example, valHSTSFromXML is an example value, this should be configured according to the security requirements.

With this Jira, users can set required headers by prefixing HTTP header with hadoop.http.header. and configure with the required value in their core-site.xml.

Example:

<property>
  <name>hadoop.http.header.http-header</name>
  <value>http-header-value</value>
</property>

 
A regex matcher will lift these properties and add into the response header when Jetty prepares the response.

Issue Links

• relates to: HBASE-23303 Add security headers to REST server/info page
• relates to: YARN-11661 Adding new property to configure the "SameSite" cookie attribute on YARN UI