[
https://issues.apache.org/jira/browse/NIFI-14946?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18019382#comment-18019382
]
Joe Witt commented on NIFI-14946:
---------------------------------
Our flexibility on such matters changed dramatically when NiFi ended up on some
very unflattering security reports because so many people ran it completely
unsecured, attached it to the Internet, and scanners found them all. Every one
of these users opted into this behavior but the reputational cost is
significant and problematic for the health of the project. We're now far more
secure by default minded and less flexible on these matters. In return though
we're more willing to engage and help find paths that ARE secure.
> Override Jetty Settings in the HandleHttpRequest processor
> ----------------------------------------------------------
>
> Key: NIFI-14946
> URL: https://issues.apache.org/jira/browse/NIFI-14946
> Project: Apache NiFi
> Issue Type: Improvement
> Reporter: Nick
> Assignee: David Handermann
> Priority: Major
>
> Jetty currently enforces a check that the `Host` header in the HTTP request
> is a valid subject in the Certificate (and if not, it fails with an `Invalid
> SNI` error - which is not correctly worked but it is done in the same part of
> the code that does check that the SNI server_name matches a valid SAN).
> There are cases where (in an organization) it is acceptable for the client to
> deal with the issue of TLS trust, and allow the server (created by
> HandleHttpRequest) to serve, no matter the hostname.
> It would be nice to be able to configure some of the settings of the
> [SecureRequestCustomizer|https://javadoc.jetty.org/jetty-12/org/eclipse/jetty/server/SecureRequestCustomizer.html]
> This could be done by either:
> * adding some explicit configurable properties to the HandleHttpRequest
> processor, or
> * making a new Service for configuring the SecureRequestCustomizer
> I think the latter option is ideal, as it could be reused by another other
> processor that creates a Jetty server.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
