[HBASE-27811] Enable cache control for logs endpoint and set max age as 0

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 3.0.0-alpha-4
• Hadoop Flags: Reviewed
• Assignee: Yash Dodeja
• Reporter: Yash Dodeja
• Created: 26/Apr/23 04:47
• Updated: 20/Feb/24 09:46
• Resolved: 29/May/23 05:52

Description

Not setting the proper header values may cause browsers to store pages within their respective caches. On public, shared, or any other non-private computers, a malicious person may search through the browser cache to locate sensitive information cached during another user's session.

/logs endpoint contains sensitive information that an attacker can exploit.

Any page with sensitive information needs to have the following headers in response:
Cache-Control: no-cache, no-store, max-age=0
Pragma: no-cache
Expires: -1

Issue Links

• is cloned by: HBASE-28367 Backport "HBASE-27811 Enable cache control for logs endpoint and set max age as 0" to branch-2
• links to: GitHub Pull Request #5204