This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch fix/webapp-cors-filter-defaults in repository https://gitbox.apache.org/repos/asf/storm.git
commit e4d7bd4c4b942cb056e096f8d312b588e91af5a2 Author: Richard Zowalla <[email protected]> AuthorDate: Wed Aug 19 08:35:10 2026 +0200 Set the CORS filter credentials parameter explicitly instead of a header name that the filter ignores --- .../main/java/org/apache/storm/daemon/ui/UIHelpers.java | 2 +- .../java/org/apache/storm/daemon/ui/UIHelpersTest.java | 15 ++++++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java index 2e4f64f2f..f1293ac05 100644 --- a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java +++ b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java @@ -321,7 +321,7 @@ public class UIHelpers { CrossOriginFilter.ALLOWED_HEADERS_PARAM, "X-Requested-With, X-Requested-By, Access-Control-Allow-Origin," + " Content-Type, Content-Length, Accept, Origin"); - filterHolder.setInitParameter(CrossOriginFilter.ACCESS_CONTROL_ALLOW_ORIGIN_HEADER, "*"); + filterHolder.setInitParameter(CrossOriginFilter.ALLOW_CREDENTIALS_PARAM, "false"); return filterHolder; } diff --git a/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java b/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java index 852af5cb9..8c58f9b9e 100644 --- a/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java +++ b/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java @@ -30,6 +30,8 @@ import org.apache.storm.generated.TopologyPageInfo; import org.apache.storm.generated.TopologyStats; import org.apache.storm.utils.Time; import net.minidev.json.JSONValue; +import org.eclipse.jetty.ee10.servlet.FilterHolder; +import org.eclipse.jetty.ee10.servlets.CrossOriginFilter; import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeEach; import org.junit.jupiter.api.Test; @@ -665,4 +667,15 @@ class UIHelpersTest { assertEquals("application/json;charset=utf-8", headers.get("Content-Type")); assertEquals("nosniff", headers.get("X-Content-Type-Options")); } -} \ No newline at end of file + + @Test + public void testCorsFilterHandleSetsExplicitInitParameters() { + FilterHolder filterHolder = UIHelpers.corsFilterHandle(); + assertEquals("*", filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM)); + assertEquals("GET, POST, PUT", filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_METHODS_PARAM)); + assertEquals("X-Requested-With, X-Requested-By, Access-Control-Allow-Origin," + + " Content-Type, Content-Length, Accept, Origin", + filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_HEADERS_PARAM)); + assertEquals("false", filterHolder.getInitParameter(CrossOriginFilter.ALLOW_CREDENTIALS_PARAM)); + } +}
