[IMPALA-10201] WebUI CSP best practice

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: Impala 4.0.0
• Component/s: Security
• Labels: newbie ramp-up
• Epic Color: ghx-label-14
• Assignee: Tamas Mate
• Reporter: Tamas Mate
• Created: 01/Oct/20 08:36
• Updated: 07/Apr/22 12:31
• Resolved: 07/Apr/22 12:31

Description

The Debug WebUI currently supports only the X-Frame-Options header, which is necessary due to backward compatibility, however in the future it will be replaced by the Content Security Policy’s frame-ancestors directive:

Content Security Policy’s frame-ancestors directive obsoletes the X-Frame-Options header. If a resource has both policies, the frame-ancestors policy SHOULD be enforced and the X-Frame-Options policy SHOULD be ignored [w3.org].

As described in Section 2.3.2.2, not all browsers implement X-Frame-Options in exactly the same way, which can lead to unintended results. And, given that the "X-" construction is deprecated [RFC6648], the X-Frame-Options header field will be replaced in the future by the Frame-Options directive in the Content Security Policy (CSP) version 1.1 [CSP-1-1]. [RFC 7034]

CSP's frame-ancestor header should be implemented to adhere the current security best practices and depending on a deprecated feature in the future.

Issue Links

• duplicates: IMPALA-11078 Webui should return a Content-Security-Policy header