This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/storm.git
commit ef60c8fe68d49479b9c5e2b0ed8c641ee934dfd6 Author: Richard Zowalla <[email protected]> AuthorDate: Mon Apr 13 19:57:02 2026 +0200 Hardening: fix CORS filter init params in UIHelpers ALLOWED_ORIGINS_PARAM was mistakenly reused for the methods and headers init parameters, causing the allowed methods and allowed headers configuration to be silently dropped (and overwriting the origins value). Use ALLOWED_METHODS_PARAM and ALLOWED_HEADERS_PARAM so the CrossOriginFilter is configured as intended. --- SECURITY.md | 9 ++++++--- .../src/main/java/org/apache/storm/daemon/ui/UIHelpers.java | 4 ++-- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 1d1bb5225..366c10271 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,9 +1,12 @@ # Running Apache Storm Securely Apache Storm offers a range of configuration options when trying to secure -your cluster. By default all authentication and authorization is disabled but -can be turned on as needed. Many of these features only became available in -Storm-0.10. +your cluster. By default, all authentication and authorization is disabled but +can be turned on as needed. + ++For the assumptions, trust boundaries, and scope of what Storm considers a security vulnerability, see the ++ [Apache Storm Security Model](https://storm.apache.org/security-model.html). Reading it first is recommended before reporting sec ++urity issues. ## Firewall/OS level Security diff --git a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java index 90e10110b..274d5a0bd 100644 --- a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java +++ b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java @@ -316,9 +316,9 @@ public class UIHelpers { public static FilterHolder corsFilterHandle() { FilterHolder filterHolder = new FilterHolder(new CrossOriginFilter()); filterHolder.setInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM, "*"); - filterHolder.setInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM, "GET, POST, PUT"); + filterHolder.setInitParameter(CrossOriginFilter.ALLOWED_METHODS_PARAM, "GET, POST, PUT"); filterHolder.setInitParameter( - CrossOriginFilter.ALLOWED_ORIGINS_PARAM, + CrossOriginFilter.ALLOWED_HEADERS_PARAM, "X-Requested-With, X-Requested-By, Access-Control-Allow-Origin," + " Content-Type, Content-Length, Accept, Origin"); filterHolder.setInitParameter(CrossOriginFilter.ACCESS_CONTROL_ALLOW_ORIGIN_HEADER, "*");
