mattcasters commented on code in PR #8390: URL: https://github.com/apache/hop/pull/8390#discussion_r4024059344
########## docs/hop-user-manual/modules/ROOT/pages/hop-gui/hop-web.adoc: ########## @@ -510,6 +510,39 @@ After sign-in, your session should include the *Admin* role (`security.manage`) Other users without a mapping fall back to the *User* role. ==== +=== Cross-site requests to the Hop Server API + +Hop Web co-deploys the Hop Server API on `/hop/*`. +Those servlets answer state-changing operations on `GET` — a single URL starts a pipeline, stops a workflow or removes one — so without a check, a web page an operator happens to be visiting can drive them in the operator's browser, using the session cookie the browser attaches by itself. + +Hop Web therefore rejects requests whose https://developer.mozilla.org/docs/Web/HTTP/Headers/Sec-Fetch-Site[`Sec-Fetch-Site`] header says they were started by another site, answering `403 Forbidden` before authentication and before the RBAC check run. +This is the same policy the standalone xref:hop-server/index.adoc[Hop Server] applies, and it is set the same way: + +[options="header"] +|=== + +|Value|Behaviour + +|`same-site` +|The default. +Rejects requests started by a site on a different registrable domain. + +|`same-origin` +|Also rejects requests started by another host of the same domain, so only Hop Web's own pages may drive the API. + +|`off` +|Does not look at `Sec-Fetch-Site` at all. + +|=== + +Set it in *Configuration → Security → General*, as `crossSitePolicy` in `security-config.json`, or with the `HOP_SERVER_CROSS_SITE_POLICY` environment variable (which overrides the config file). +A `crossSitePolicy` init-param on the `CrossSiteRequest` filter in `web.xml` pins it for a single deployment and wins over both. Review Comment: **[suggestion]** This section tells operators the `CrossSiteRequest` filter lives in `web.xml`, but the “Full web.xml with Tomcat BASIC (single role, EXTERNAL)” sample later on the same page still maps `/hop/*` with no `CrossSiteRequest` filter. `docker/resources/run-web.sh` copies `/config/web.xml` over the shipped `WEB-INF/web.xml`, so following that sample drops the CSRF check. Container BASIC still attaches cached credentials to cross-site GET, which is exactly the attack this PR is closing. `docker/local-auth-config/web.xml` was updated; this documented overlay was not. **Suggestion:** Add the `CrossSiteRequest` filter (mapped on `/hop/*`, before other filters) to that sample, or change the sample to a fragment that only adds the Tomcat `<security-constraint>` / `<login-config>` on top of the default `web.xml` rather than replacing it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
