[OOZIE-3312] Add support for HSTS

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 5.2.0
• Component/s: security
• Assignee: Kinga Marton
• Reporter: Gézapeti
• Created: 02/Aug/18 09:14
• Updated: 09/Dec/19 08:54
• Resolved: 11/Mar/19 10:54

Description

As a security best practice we should add support for HSTS via oozie-site.xml in case of embedded Jetty.
https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet
http://www.eclipse.org/jetty/documentation/9.3.x/embedded-examples.html - this page is not available anymore

https://www.eclipse.org/jetty/documentation/9.4.15.v20190215/embedded-examples.html

 

Maybe we should even make it enabled by default when SSL is configured.

Issue Links

• links to: Review Board