[NIFI-12487] Add CSRF Filter to Registry Configuration

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.0.0-M2
• Component/s: NiFi Registry, Security
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 07/Dec/23 02:45
• Updated: 18/Dec/23 20:08
• Resolved: 18/Dec/23 20:08

Description

NiFi Registry supports several authentication strategies including username and password, X.509 certificates, and OpenID Connect. Strategies that involve exchanging temporary credentials produce an Application Bearer Token, which the Registry interface stores and sends on subsequent requests for the duration of the session. The Registry interface passes the Bearer Token using the standard HTTP Authorization header, which requires custom JavaScript request processing. This approach mitigates general concerns related to Cross-Site Request Forgery as external requests from a web browser cannot send the Authorization header.

Despite general protection based on the current implementation, adding standard Cross-Site Request Forgery checking using Spring Security would provide additional defenses. Enabling CSRF protection also aligns with existing capabilities in NiFi, and would provide a basis for future align of Bearer Token handling strategies.

Issue Links

• links to: GitHub Pull Request #8136