Arafat Khan created KNOX-3530:
---------------------------------
Summary: Ozone Recon UI broken through Knox: JS served as
text/javascript is not rewritten
Key: KNOX-3530
URL: https://issues.apache.org/jira/browse/KNOX-3530
Project: Apache Knox
Issue Type: Bug
Components: KnoxSSO
Reporter: Arafat Khan
When you open the Ozone Recon UI through Knox
({{{}https://<knox-host>:8443/gateway/<topology>/ozone-recon/{}}}), the page
loads but every API call fails with 404. The browser calls
{{https://<knox-host>:8443/api/v1/clusterState}} without the
{{/gateway/<topology>/ozone-recon/}} prefix, so the requests never reach Recon.
Recon itself is healthy and works fine when opened directly.
*Root cause:*
Knox makes Recon work behind the gateway by rewriting Recon's JavaScript files
on the way to the browser. It adds the gateway prefix to links like
{{{}/api/v1/clusterState{}}}. The rule that does this is in
{{{}ozone-recon/1.2.0/rewrite.xml{}}}, and it only applies to responses with
Content-Type {{{}application/javascript{}}}.
Apache Ozone has upgraded Recon's web server from Jetty 9.4 to Jetty 12
(HDDS-8280 and HDDS-16683). Jetty 12 serves {{.js}} files as
{{text/javascript}} by default, where Jetty 9.4 used
{{{}application/javascript{}}}. Knox doesn't match the new type, so it skips
the rewrite and passes the JS through unchanged. The browser then calls the
wrong URLs.
You can see the change in Jetty's own {{{}mime.properties{}}}: Jetty 9.4 maps
{{js=application/javascript}} and Jetty 12 maps {{{}js=text/javascript{}}}.
* *Recon on Jetty 9.4:* the JS through Knox contains
{{{}https://<knox-host>:8443/gateway/<topology>/ozone-recon/api/v1/clusterState{}}}.
Works.
* *Recon on Jetty 12:* the JS through Knox still contains the bare
{{{}/api/v1/clusterState{}}}, exactly as Recon sent it. Fails.
*Fix:*
In
{{{}gateway-service-definitions/src/main/resources/services/ozone-recon/1.2.0/rewrite.xml{}}},
change {{<content type="application/javascript">}} to {{{}<content
type="*/javascript">{}}}. Knox already supports this wildcard, and it matches
both {{application/javascript}} and {{{}text/javascript{}}}. The {{{}ozone{}}},
{{{}ozone-scm{}}}, {{hdfsui}} and {{hue}} service definitions already use it.
We tested the fix by updating the ozone-recon service definition on a Knox
gateway in front of a Jetty 12 Recon and restarting Knox. The JS served through
Knox then had the correct prefixed URLs, and the Recon UI worked through Knox.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
