[NIFI-9060] HTTP Cookie Paths ignore Proxy Context Path Headers

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.14.0, 1.15.0
• Fix Version/s: 1.15.0
• Component/s: Core Framework, Security
• Labels: security
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 18/Aug/21 20:38
• Updated: 23/Sep/21 22:08
• Resolved: 23/Sep/21 22:08

Description

HTTP cookies that NiFi uses for authentication have hard-coded paths set to forward-slash.  This is acceptable for deployments where clients have direct access to NiFi, or when a reverse proxy does not rewrite the context path. In deployments where a reverse proxy performs URL rewriting, NiFi should set cookie path based on proxy HTTP headers. NiFi WebUtils includes methods to determine the context path based on supported proxy headers, which should be used to set the paths for HTTP cookies.

Issue Links

• fixes: NIFI-7033 wrong redirect from login/logout page when behind a custom url prefix/context
• links to: GitHub Pull Request #5329