[NIFI-11558] Apply Security Headers to All Responses from Registry

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 2.0.0-M1, 1.22.0
• Component/s: NiFi Registry, Security
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 17/May/23 01:39
• Updated: 23/May/23 11:18
• Resolved: 23/May/23 11:18

Description

NiFi Registry has a common set of filters that apply several standard security-related HTTP headers to responses. The Jetty Server configuration applies these headers to the Registry API and UI applications, but requests to the root path do not return these headers, which can be misleading to some automated security scanners. For a consistent approach, the security-related headers should be applied using a Jetty Handler that works for all requests and responses.

Issue Links

• links to: GitHub PR 7258
• links to: GitHub Pull Request #7258