[NIFI-10855] Document Cross-Site Request Forgery Protection

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.20.0
• Component/s: Core UI, Documentation & Website
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 21/Nov/22 23:21
• Updated: 24/Dec/22 18:16
• Resolved: 24/Dec/22 18:16

Description

Apache NiFi 1.15.0 included significant changes to web application security, including the introduction of Cross-Site Request Forgery protection using Spring Security Filters.

The CSRF configuration builds on the standard Spring Security Filter and provides a stateless implementation based on the Double Submit Cookie Pattern. The implementation maintains support for REST API access without cookies using the HTTP Authorization header, but documenting the implementation would provide additional background for clients integrating with the REST API.

Issue Links

• is related to: NIFI-9241 Review CORS Security Configuration
• links to: GitHub Pull Request #6805