[
https://issues.apache.org/jira/browse/HADOOP-15457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16976818#comment-16976818
]
Bharat Viswanadham commented on HADOOP-15457:
---------------------------------------------
These are added by default
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Users does not need to do anything for above headers. To add customized
additional headers, it should be added as below to core-site.xml.
<property>
<name>hadoop.http.header.http-header</name>
<value>http-header-val</value>
</property>
Now for adding HSTS header, it should be added like below, values need to be
customized according to customer security needs.
<property>
<name>hadoop.http.header.Strict_Transport_Security</name>
<value>max-age=7200; includeSubDomains; preload</value>
</property>
> Add Security-Related HTTP Response Header in WEBUIs.
> ----------------------------------------------------
>
> Key: HADOOP-15457
> URL: https://issues.apache.org/jira/browse/HADOOP-15457
> Project: Hadoop Common
> Issue Type: Improvement
> Reporter: Kanwaljeet Sachdev
> Assignee: Kanwaljeet Sachdev
> Priority: Major
> Labels: security
> Fix For: 3.2.0
>
> Attachments: HADOOP-15457.001.patch, HADOOP-15457.002.patch,
> HADOOP-15457.003.patch, HADOOP-15457.004.patch, HADOOP-15457.005.patch,
> YARN-8198.001.patch, YARN-8198.002.patch, YARN-8198.003.patch,
> YARN-8198.004.patch, YARN-8198.005.patch
>
>
> As of today, YARN web-ui lacks certain security related http response
> headers. We are planning to add few default ones and also add support for
> headers to be able to get added via xml config. Planning to make the below
> two as default.
> * X-XSS-Protection: 1; mode=block
> * X-Content-Type-Options: nosniff
>
> Support for headers via config properties in core-site.xml will be along the
> below lines
> {code:java}
> <property>
> <name>hadoop.http.header.Strict_Transport_Security</name>
> <value>valHSTSFromXML</value>
> </property>{code}
> In the above example, valHSTSFromXML is an example value, this should be
> configured according to the security requirements.
> With this Jira, users can set required headers by prefixing HTTP header with
> hadoop.http.header. and configure with the required value in their
> core-site.xml.
> Example:
>
> {code:java}
> <property>
> <name>hadoop.http.header.http-header>
> <value>http-header-value</value>
> </property>
> {code}
>
> A regex matcher will lift these properties and add into the response header
> when Jetty prepares the response.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: common-issues-h...@hadoop.apache.org
