[YARN-11661] Adding new property to configure the "SameSite" cookie attribute on YARN UI

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Workaround
• Affects Version/s: 3.4.0
• Component/s: yarn
• Hadoop Flags: Reviewed
• Assignee: Susheel Gupta
• Reporter: Susheel Gupta
• Created: 13/Mar/24 11:54
• Updated: 14/Mar/24 07:45
• Resolved: 14/Mar/24 07:43

Description

If we use 'SameSite=Strict,' the browser would only send the cookie for same-site requests, rendering cross-site sessions ineffective.
However, it’s worth noting that while using SameSite=None with TLS does enhance the security of your cookies compared to using it without TLS, it doesn’t provide complete security. Nevertheless, considering the necessity for cross-site sessions, utilizing SameSite=None along with TLS can provide a reasonable level of security.

Issue Links

• is related to: HADOOP-15457 Add Security-Related HTTP Response Header in WEBUIs.