[HBASE-15187] Integrate CSRF prevention filter to REST gateway

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.0, 2.0.0
• Labels: rest
• Hadoop Flags: Reviewed

Release Note

Protection against CSRF attack can be turned on with config parameter, hbase.rest.csrf.enabled - default value is false.

The custom header to be sent can be changed via config parameter, hbase.rest.csrf.custom.header whose default value is "X-XSRF-HEADER".

Config parameter, hbase.rest.csrf.methods.to.ignore , controls which HTTP methods are not associated with customer header check.

Config parameter, hbase.rest-csrf.browser-useragents-regex , is a comma-separated list of regular expressions used to match against an HTTP request's User-Agent header when protection against cross-site request forgery (CSRF) is enabled for REST server by setting hbase.rest.csrf.enabled to true.

The implementation came from hadoop/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/security/http/RestCsrfPreventionFilter.java

We should periodically update the RestCsrfPreventionFilter.java in hbase codebase to include fixes to the hadoop implementation.

• Assignee: Ted Yu
• Reporter: Ted Yu
• Created: 29/Jan/16 15:46
• Updated: 09/Jan/18 20:10
• Resolved: 16/Apr/16 05:35

Description

HADOOP-12691 introduced a filter in Hadoop Common to help REST APIs guard against cross-site request forgery attacks.

This issue tracks the integration of that filter into HBase REST gateway.

From REST section of refguide:

To delete a table, use a DELETE request with the /schema endpoint:
http://example.com:8000<table>/schema

Suppose an attacker hosts a malicious web form on a domain under his control. The form uses the DELETE action targeting a REST URL. Through social engineering, the attacker tricks an authenticated user into accessing the form and submitting it.

The browser sends the HTTP DELETE request to the REST gateway.
At REST gateway, the call is executed and user table is dropped

Issue Links

• is related to: HBASE-19741 Port CSRF prevention filter (HBASE-15187) to the HBase Thrift server
• relates to: YARN-4737 Add CSRF filter support in YARN
• relates to: HDFS-9711 Integrate CSRF prevention filter in WebHDFS.