(storm) branch master updated: Set the CORS filter credentials parameter explicitly instead of a header name that the filter ignores

[rzo1]

This is an automated email from the ASF dual-hosted git repository.

rzo1 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/storm.git


The following commit(s) were added to refs/heads/master by this push:
     new ed585b884 Set the CORS filter credentials parameter explicitly instead 
of a header name that the filter ignores
ed585b884 is described below

commit ed585b884f4ea218fd002b7ee386acf03b32e5fa
Author: Richard Zowalla <r...@apache.org>
AuthorDate: Wed Aug 19 08:35:10 2026 +0200

    Set the CORS filter credentials parameter explicitly instead of a header 
name that the filter ignores
---
 .../src/main/java/org/apache/storm/daemon/ui/UIHelpers.java |  2 +-
 .../test/java/org/apache/storm/daemon/ui/UIHelpersTest.java | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git 
a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java 
b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java
index 77f43a398..aaa323fd8 100644
--- a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java
+++ b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java
@@ -324,7 +324,7 @@ public class UIHelpers {
                 CrossOriginFilter.ALLOWED_HEADERS_PARAM,
                 "X-Requested-With, X-Requested-By, 
Access-Control-Allow-Origin,"
                         + " Content-Type, Content-Length, Accept, Origin");
-        
filterHolder.setInitParameter(CrossOriginFilter.ACCESS_CONTROL_ALLOW_ORIGIN_HEADER,
 "*");
+        
filterHolder.setInitParameter(CrossOriginFilter.ALLOW_CREDENTIALS_PARAM, 
"false");
         return filterHolder;
     }
 
diff --git 
a/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java 
b/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java
index 1ef066b8e..09a31f244 100644
--- a/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java
+++ b/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java
@@ -30,6 +30,8 @@ import org.apache.storm.generated.TopologyPageInfo;
 import org.apache.storm.generated.TopologyStats;
 import org.apache.storm.utils.Time;
 import net.minidev.json.JSONValue;
+import org.eclipse.jetty.ee10.servlet.FilterHolder;
+import org.eclipse.jetty.ee10.servlets.CrossOriginFilter;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ServerConnector;
 import org.eclipse.jetty.server.SslConnectionFactory;
@@ -724,4 +726,15 @@ class UIHelpersTest {
         assertEquals(expectedProtocols, new 
LinkedHashSet<>(Arrays.asList(factory.getExcludeProtocols())));
         assertEquals(expectedCiphers, new 
LinkedHashSet<>(Arrays.asList(factory.getExcludeCipherSuites())));
     }
+
+    @Test
+    public void testCorsFilterHandleSetsExplicitInitParameters() {
+        FilterHolder filterHolder = UIHelpers.corsFilterHandle();
+        assertEquals("*", 
filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM));
+        assertEquals("GET, POST, PUT", 
filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_METHODS_PARAM));
+        assertEquals("X-Requested-With, X-Requested-By, 
Access-Control-Allow-Origin,"
+                + " Content-Type, Content-Length, Accept, Origin",
+                
filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_HEADERS_PARAM));
+        assertEquals("false", 
filterHolder.getInitParameter(CrossOriginFilter.ALLOW_CREDENTIALS_PARAM));
+    }
 }