[NIFI-9995] Replace Custom Header Filters with Spring Security Filters

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.17.0
• Component/s: Core Framework
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 06/May/22 13:13
• Updated: 27/Jul/22 03:33
• Resolved: 06/May/22 16:24

Description

The NiFi Jetty Server uses the following custom Servlet Filters to apply standard security-related  HTTP response headers:

• ContentSecurityPolicyFilter
• StrictTransportSecurityFilter
• XContentTypeOptionsFilter
• XFrameOptionsFilter
• XSSProtectionFilter

Spring Security includes a standard HeaderWriterFilter with standard writers for all of these response headers. Replacing multiple Servlet Filters with a single Filter simplifies the filter chain invocation for all HTTP requests and provides the same response headers.

Issue Links

• causes: NIFI-10284 HTTP Request Log Missing Authenticated User
• links to: GitHub Pull Request #6020