Details

    • Type: Sub-task
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 2.9.0, 3.0.0, 3.1.0
    • Component/s: yarn-ui-v2
    • Labels:
      None
    • Hadoop Flags:
      Reviewed

      Description

      Opening jira as suggested b Eric Yang on the thread for merging YARN-3368 (new web UI) to branch2 http://mail-archives.apache.org/mod_mbox/hadoop-yarn-dev/201610.mbox/%3CCAD++eCmVVQNZQz9YnkVKcXaCzdkg50YiOFxktgk3mMMs9sHmUA@mail.gmail.com%3E

      ----------
      Ui2 does not seem to support same origin policy for cross site scripting prevention.
      The following parameters has no effect for /ui2:

      hadoop.http.cross-origin.enabled = true
      yarn.resourcemanager.webapp.cross-origin.enabled = true

      This is because ui2 is designed as a separate web application. WebFilters setup for existing resource manager doesn’t apply to the new web application.
      Please open JIRA to track the security issue and resolve the problem prior to backporting this to branch-2.
      This would minimize the risk to open up security hole in branch-2.

      ----------

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                sunilg Sunil Govindan
                Reporter:
                vrushalic Vrushali C
              • Votes:
                0 Vote for this issue
                Watchers:
                8 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: