holdenk commented on code in PR #58640:
URL: https://github.com/apache/spark/pull/58640#discussion_r4042404623
##########
core/src/main/scala/org/apache/spark/internal/config/UI.scala:
##########
@@ -105,6 +105,21 @@ private[spark] object UI {
.booleanConf
.createWithDefault(true)
+ val UI_KILL_VIA_GET_ENABLED = ConfigBuilder("spark.ui.killViaGetEnabled")
+ .doc("Whether the job/stage kill endpoints of the web UI accept HTTP GET
requests in " +
+ "addition to POST. Unset, this defaults to true when spark.master is
yarn, because " +
+ "the YARN ResourceManager/AM proxy does not forward POST requests
(SPARK-6846), and " +
+ "to false everywhere else. Either way the state-changing endpoints
require the " +
+ "random per-UI CSRF token embedded in the links and forms the UI
renders, and " +
+ "reject prefetch requests (Purpose/Sec-Purpose/X-Moz headers) and HEAD
requests, so " +
+ "forged cross-site requests and incidental link fetches cannot trigger
them; " +
+ "prefetch rejection relies on the prefetcher identifying itself via
those headers. " +
+ "Introduced in 4.3.0; also available in 3.5.10, 4.0.5, 4.1.4 and 4.2.1;
and in all " +
Review Comment:
I've been on the fence as to how to mention backported version where we
backport a config flag so yeah I'm down to remove it (and yes I have a seperate
3.5 branch I'll update and raise once we land this one). Is there another way
we should go about mentioning backported versions? Or just drop entirely.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
