[SPARK-45248] Slow HTTP Denial of Service Attack【jetty server in spark】

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.5.0
• Fix Version/s: 4.0.0
• Component/s: Spark Core
• Labels: pull-request-available
• Assignee: chenyu
• Reporter: chenyu
• Created: 21/Sep/23 06:15
• Updated: 26/Sep/23 03:39
• Resolved: 26/Sep/23 03:38

Description

The Jetty server may be slow HTTP denial of service attacks in spark ui.

The default value of connector IdleTimeout is 30000.

This could trigger such an attack

Issue Links

• links to: GitHub Pull Request #43027
• links to: GitHub Pull Request #43028
• links to: GitHub Pull Request #43078