This is an automated email from the ASF dual-hosted git repository.
pvillard31 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git
The following commit(s) were added to refs/heads/main by this push:
new e6baf38b9ff NIFI-15967 Adjust Proxy Header Validation for Replicated
Requests (#11273)
e6baf38b9ff is described below
commit e6baf38b9ffd3db46ffbb9dce16c560116351326
Author: David Handermann <[email protected]>
AuthorDate: Fri May 22 13:29:09 2026 -0500
NIFI-15967 Adjust Proxy Header Validation for Replicated Requests (#11273)
---
.../http/replication/ReplicationHeaderUtils.java | 6 +-
.../http/replication/RequestReplicationHeader.java | 10 ---
.../StandardUploadRequestReplicator.java | 3 +-
.../replication/ThreadPoolRequestReplicator.java | 3 +-
...TestStandardUploadRequestReplicatorHeaders.java | 9 +--
.../coordination/http/ReplicationHeader.java | 35 ++++++++++
.../connector/ProxyHeaderValidatorCustomizer.java | 42 +++++++++++-
.../web/server/StandardServerProviderTest.java | 76 ++++++++++++++++++++--
.../apache/nifi/web/api/ApplicationResource.java | 3 +-
9 files changed, 161 insertions(+), 26 deletions(-)
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/ReplicationHeaderUtils.java
b/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/ReplicationHeaderUtils.java
index a5c4de9201c..947393a54fe 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/ReplicationHeaderUtils.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/ReplicationHeaderUtils.java
@@ -18,6 +18,7 @@ package org.apache.nifi.cluster.coordination.http.replication;
import org.apache.commons.lang3.StringUtils;
import org.apache.nifi.authorization.user.NiFiUser;
+import org.apache.nifi.cluster.coordination.http.ReplicationHeader;
import org.apache.nifi.web.security.ProxiedEntitiesUtils;
import org.apache.nifi.web.security.http.SecurityCookieName;
import org.apache.nifi.web.security.http.SecurityHeader;
@@ -96,13 +97,16 @@ public final class ReplicationHeaderUtils {
}
/**
- * Removes all {@link RequestReplicationHeader} names from the map
(case-insensitive) so
+ * Removes all request replication header names from the map
(case-insensitive) so
* that inbound client requests cannot spoof replication protocol headers.
*/
public static void stripRequestReplicationHeaders(final Map<String,
String> headers) {
for (final RequestReplicationHeader rh :
RequestReplicationHeader.values()) {
removeHeader(headers, rh.getHeader());
}
+ for (final ReplicationHeader rh : ReplicationHeader.values()) {
+ removeHeader(headers, rh.getHeader());
+ }
}
/**
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/RequestReplicationHeader.java
b/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/RequestReplicationHeader.java
index 3da60e5c069..30c1912fc0e 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/RequestReplicationHeader.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/RequestReplicationHeader.java
@@ -44,16 +44,6 @@ public enum RequestReplicationHeader {
*/
REPLICATION_TARGET_ID("replication-target-id"),
- /**
- * When we replicate a request across the cluster, we replicate it only
from the cluster coordinator.
- * If the request needs to be replicated by another node, it first
replicates the request to the coordinator,
- * which then replicates the request on the node's behalf. This header
name and value are used to denote
- * that the request has already been to the cluster coordinator, and the
cluster coordinator is the one replicating
- * the request. This allows us to know that the request should be
serviced, rather than proxied back to the
- * cluster coordinator.
- */
- REQUEST_REPLICATED("request-replicated"),
-
/**
* Transaction Identifier for replicated requests
*/
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/StandardUploadRequestReplicator.java
b/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/StandardUploadRequestReplicator.java
index 9fbbd1c52e0..126a09bc2df 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/StandardUploadRequestReplicator.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/StandardUploadRequestReplicator.java
@@ -20,6 +20,7 @@ package org.apache.nifi.cluster.coordination.http.replication;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.apache.commons.io.IOUtils;
import org.apache.nifi.cluster.coordination.ClusterCoordinator;
+import org.apache.nifi.cluster.coordination.http.ReplicationHeader;
import org.apache.nifi.cluster.protocol.NodeIdentifier;
import org.apache.nifi.util.NiFiProperties;
import org.apache.nifi.util.file.FileUtils;
@@ -191,7 +192,7 @@ public class StandardUploadRequestReplicator implements
UploadRequestReplicator
ReplicationHeaderUtils.applyUserProxyAndStripCredentials(headers,
uploadRequest.getUser());
headers.put(RequestReplicationHeader.EXECUTION_CONTINUE.getHeader(),
Boolean.TRUE.toString());
- headers.put(RequestReplicationHeader.REQUEST_REPLICATED.getHeader(),
Boolean.TRUE.toString());
+ headers.put(ReplicationHeader.REQUEST_REPLICATED.getHeader(),
Boolean.TRUE.toString());
return headers;
}
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/ThreadPoolRequestReplicator.java
b/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/ThreadPoolRequestReplicator.java
index fe79e356b72..de58db4f201 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/ThreadPoolRequestReplicator.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/main/java/org/apache/nifi/cluster/coordination/http/replication/ThreadPoolRequestReplicator.java
@@ -25,6 +25,7 @@ import org.apache.nifi.authorization.user.NiFiUser;
import org.apache.nifi.authorization.user.NiFiUserUtils;
import org.apache.nifi.cluster.coordination.ClusterCoordinator;
import org.apache.nifi.cluster.coordination.http.HttpResponseMapper;
+import org.apache.nifi.cluster.coordination.http.ReplicationHeader;
import org.apache.nifi.cluster.coordination.http.StandardHttpResponseMapper;
import
org.apache.nifi.cluster.coordination.http.endpoints.ConnectionEndpointMerger;
import
org.apache.nifi.cluster.coordination.http.endpoints.ConnectorEndpointMerger;
@@ -257,7 +258,7 @@ public class ThreadPoolRequestReplicator implements
RequestReplicator, Closeable
updatedHeaders.put(RequestReplicationHeader.CLUSTER_ID_GENERATION_SEED.getHeader(),
ComponentIdGenerator.generateId().toString());
if (indicateReplicated) {
-
updatedHeaders.put(RequestReplicationHeader.REQUEST_REPLICATED.getHeader(),
Boolean.TRUE.toString());
+
updatedHeaders.put(ReplicationHeader.REQUEST_REPLICATED.getHeader(),
Boolean.TRUE.toString());
}
// include the proxied entities header and strip untrusted headers
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/test/java/org/apache/nifi/cluster/coordination/http/replication/TestStandardUploadRequestReplicatorHeaders.java
b/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/test/java/org/apache/nifi/cluster/coordination/http/replication/TestStandardUploadRequestReplicatorHeaders.java
index ecc8a7fc116..64125696c88 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/test/java/org/apache/nifi/cluster/coordination/http/replication/TestStandardUploadRequestReplicatorHeaders.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-framework-cluster/src/test/java/org/apache/nifi/cluster/coordination/http/replication/TestStandardUploadRequestReplicatorHeaders.java
@@ -18,6 +18,7 @@ package org.apache.nifi.cluster.coordination.http.replication;
import org.apache.nifi.authorization.user.StandardNiFiUser;
import org.apache.nifi.cluster.coordination.ClusterCoordinator;
+import org.apache.nifi.cluster.coordination.http.ReplicationHeader;
import org.apache.nifi.util.NiFiProperties;
import org.apache.nifi.web.client.api.WebClientService;
import org.apache.nifi.web.security.ProxiedEntitiesUtils;
@@ -111,14 +112,14 @@ class TestStandardUploadRequestReplicatorHeaders {
@Test
void testReplicationHeadersFromForwardedInputAreStripped() {
final Map<String, String> forwarded = new HashMap<>();
- forwarded.put(RequestReplicationHeader.REQUEST_REPLICATED.getHeader(),
SPOOFED_VALUE);
+ forwarded.put(ReplicationHeader.REQUEST_REPLICATED.getHeader(),
SPOOFED_VALUE);
forwarded.put(RequestReplicationHeader.EXECUTION_CONTINUE.getHeader(),
SPOOFED_VALUE);
forwarded.put(RequestReplicationHeader.REQUEST_TRANSACTION_ID.getHeader(),
SPOOFED_TX_VALUE);
final UploadRequest<String> request = buildUploadRequest(forwarded);
final Map<String, String> result =
replicator.buildOutboundHeaders(request);
- assertEquals(Boolean.TRUE.toString(),
result.get(RequestReplicationHeader.REQUEST_REPLICATED.getHeader()));
+ assertEquals(Boolean.TRUE.toString(),
result.get(ReplicationHeader.REQUEST_REPLICATED.getHeader()));
assertEquals(Boolean.TRUE.toString(),
result.get(RequestReplicationHeader.EXECUTION_CONTINUE.getHeader()));
assertNull(result.get(RequestReplicationHeader.REQUEST_TRANSACTION_ID.getHeader()));
}
@@ -198,7 +199,7 @@ class TestStandardUploadRequestReplicatorHeaders {
final UploadRequest<String> request = buildUploadRequest(new
HashMap<>());
final Map<String, String> result =
replicator.buildOutboundHeaders(request);
- assertEquals(Boolean.TRUE.toString(),
result.get(RequestReplicationHeader.REQUEST_REPLICATED.getHeader()));
+ assertEquals(Boolean.TRUE.toString(),
result.get(ReplicationHeader.REQUEST_REPLICATED.getHeader()));
assertEquals(Boolean.TRUE.toString(),
result.get(RequestReplicationHeader.EXECUTION_CONTINUE.getHeader()));
}
@@ -218,7 +219,7 @@ class TestStandardUploadRequestReplicatorHeaders {
final Map<String, String> result =
replicator.buildOutboundHeaders(request);
assertEquals(TEST_FILENAME, result.get(FILENAME_HEADER));
- assertEquals(Boolean.TRUE.toString(),
result.get(RequestReplicationHeader.REQUEST_REPLICATED.getHeader()));
+ assertEquals(Boolean.TRUE.toString(),
result.get(ReplicationHeader.REQUEST_REPLICATED.getHeader()));
assertNotNull(result.get(ProxiedEntitiesUtils.PROXY_ENTITIES_CHAIN));
}
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/cluster/coordination/http/ReplicationHeader.java
b/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/cluster/coordination/http/ReplicationHeader.java
new file mode 100644
index 00000000000..d7fddda3357
--- /dev/null
+++
b/nifi-framework-bundle/nifi-framework/nifi-framework-core/src/main/java/org/apache/nifi/cluster/coordination/http/ReplicationHeader.java
@@ -0,0 +1,35 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.nifi.cluster.coordination.http;
+
+/**
+ * Enumeration of HTTP headers for Cluster Request Replication with
lowercasing for compatibility with HTTP/2
+ */
+public enum ReplicationHeader {
+ /** Boolean indicator that the Cluster Coordinator is initiating the
replicated request to other nodes */
+ REQUEST_REPLICATED("request-replicated");
+
+ private final String header;
+
+ ReplicationHeader(final String header) {
+ this.header = header;
+ }
+
+ public String getHeader() {
+ return header;
+ }
+}
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/ProxyHeaderValidatorCustomizer.java
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/ProxyHeaderValidatorCustomizer.java
index 4ed71ea7877..80e90f08ed3 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/ProxyHeaderValidatorCustomizer.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/connector/ProxyHeaderValidatorCustomizer.java
@@ -16,14 +16,19 @@
*/
package org.apache.nifi.web.server.connector;
+import org.apache.nifi.cluster.coordination.http.ReplicationHeader;
import org.apache.nifi.web.servlet.shared.ProxyHeader;
import org.eclipse.jetty.http.HttpException;
import org.eclipse.jetty.http.HttpFields;
import org.eclipse.jetty.http.HttpStatus;
import org.eclipse.jetty.http.HttpURI;
+import org.eclipse.jetty.io.Connection;
+import org.eclipse.jetty.io.EndPoint;
+import org.eclipse.jetty.server.ConnectionMetaData;
import org.eclipse.jetty.server.HttpConfiguration;
import org.eclipse.jetty.server.Request;
+import java.security.cert.X509Certificate;
import java.util.Objects;
import java.util.Set;
@@ -65,6 +70,24 @@ public class ProxyHeaderValidatorCustomizer implements
HttpConfiguration.Customi
}
private Request customizeSecureRequest(final Request request) {
+ final X509Certificate peerCertificate = findPeerCertificate(request);
+
+ // Requests not authenticated with Client Certificates require header
validation
+ if (peerCertificate == null) {
+ processProxyHostHeaders(request);
+ } else {
+ // Requests authenticated with Client Certificates but not
indicated as replicated require header validation
+ final HttpFields requestHeaders = request.getHeaders();
+ final String requestReplicated =
requestHeaders.get(ReplicationHeader.REQUEST_REPLICATED.getHeader());
+ if (requestReplicated == null) {
+ processProxyHostHeaders(request);
+ }
+ }
+
+ return request;
+ }
+
+ private void processProxyHostHeaders(final Request request) {
final HttpURI requestUri = request.getHttpURI();
final String requestHost = requestUri.getHost();
@@ -85,7 +108,24 @@ public class ProxyHeaderValidatorCustomizer implements
HttpConfiguration.Customi
throw new
HttpException.RuntimeException(HttpStatus.MISDIRECTED_REQUEST_421,
MISDIRECTED_REQUEST_REASON);
}
+ }
- return request;
+ private X509Certificate findPeerCertificate(final Request request) {
+ final X509Certificate peerCertificate;
+ final ConnectionMetaData connectionMetaData =
request.getConnectionMetaData();
+ final Connection connection = connectionMetaData.getConnection();
+ final EndPoint endPoint = connection.getEndPoint();
+ final EndPoint.SslSessionData sslSessionData =
endPoint.getSslSessionData();
+ if (sslSessionData == null) {
+ peerCertificate = null;
+ } else {
+ final X509Certificate[] peerCertificates =
sslSessionData.peerCertificates();
+ if (peerCertificates == null || peerCertificates.length == 0) {
+ peerCertificate = null;
+ } else {
+ peerCertificate = peerCertificates[0];
+ }
+ }
+ return peerCertificate;
}
}
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/test/java/org/apache/nifi/web/server/StandardServerProviderTest.java
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/test/java/org/apache/nifi/web/server/StandardServerProviderTest.java
index 825c527b649..57cd6603455 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/test/java/org/apache/nifi/web/server/StandardServerProviderTest.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/test/java/org/apache/nifi/web/server/StandardServerProviderTest.java
@@ -16,6 +16,7 @@
*/
package org.apache.nifi.web.server;
+import org.apache.nifi.cluster.coordination.http.ReplicationHeader;
import org.apache.nifi.jetty.configuration.connector.ApplicationLayerProtocol;
import org.apache.nifi.security.cert.builder.StandardCertificateBuilder;
import org.apache.nifi.security.ssl.EphemeralKeyStoreBuilder;
@@ -106,6 +107,8 @@ class StandardServerProviderTest {
private static SSLContext sslContext;
+ private static SSLContext sslContextWithoutClientCertificates;
+
@BeforeAll
static void setConfiguration() throws Exception {
final KeyPair keyPair =
KeyPairGenerator.getInstance("RSA").generateKeyPair();
@@ -120,6 +123,10 @@ class StandardServerProviderTest {
.keyPassword(PROTECTION_PARAMETER)
.build();
+ sslContextWithoutClientCertificates = new StandardSslContextBuilder()
+ .trustStore(keyStore)
+ .build();
+
// Allow Restricted Headers for testing TLS SNI
System.setProperty(ALLOW_RESTRICTED_HEADERS_PROPERTY, HOST_HEADER);
}
@@ -190,23 +197,67 @@ class StandardServerProviderTest {
assertHttpsConnectorFound(server);
try {
- server.start();
+ startServer(server);
+ final URI uri = server.getURI();
+ assertHttpsRequestsCompleted(uri);
+ } finally {
+ server.stop();
+ }
+ }
- assertFalse(server.isFailed());
+ @Timeout(15)
+ @Test
+ void testGetServerHttpsWithoutClientCertificates() throws Exception {
+ final Properties applicationProperties = new Properties();
+ applicationProperties.setProperty(NiFiProperties.WEB_HTTPS_PORT,
RANDOM_PORT);
+ // Set placeholder property to disable requiring Client Certificates
+
applicationProperties.setProperty(NiFiProperties.SECURITY_USER_LOGIN_IDENTITY_PROVIDER,
Boolean.TRUE.toString());
+ final NiFiProperties properties =
NiFiProperties.createBasicNiFiProperties((String) null, applicationProperties);
+
+ final StandardServerProvider provider = new
StandardServerProvider(sslContext);
- while (server.isStarting()) {
- TimeUnit.MILLISECONDS.sleep(250);
- }
+ final Server server = provider.getServer(properties);
- assertTrue(server.isStarted());
+ assertStandardConfigurationFound(server);
+ assertHttpsConnectorFound(server);
+ try {
+ startServer(server);
final URI uri = server.getURI();
- assertHttpsRequestsCompleted(uri);
+ assertHttpsRequestsWithoutClientCertificates(uri);
} finally {
server.stop();
}
}
+ private void startServer(final Server server) throws Exception {
+ server.start();
+
+ assertFalse(server.isFailed());
+
+ while (server.isStarting()) {
+ TimeUnit.MILLISECONDS.sleep(250);
+ }
+
+ assertTrue(server.isStarted());
+ }
+
+ void assertHttpsRequestsWithoutClientCertificates(final URI serverUri)
throws IOException, InterruptedException {
+ try (HttpClient httpClient = HttpClient.newBuilder()
+ .connectTimeout(TIMEOUT)
+ .sslContext(sslContextWithoutClientCertificates)
+ .build()
+ ) {
+ final URI localhostUri =
UriComponentsBuilder.fromUri(serverUri).host(LOCALHOST_NAME).build().toUri();
+
+ assertFrontendRedirectRequestsCompleted(httpClient, localhostUri);
+ assertBadRequestsCompleted(httpClient, localhostUri);
+ assertMisdirectedRequestsCompleted(httpClient, localhostUri);
+
+ assertReplicatedRequestCompleted(httpClient, localhostUri,
HttpStatus.MISDIRECTED_REQUEST_421);
+ }
+ }
+
void assertHttpsRequestsCompleted(final URI serverUri) throws IOException,
InterruptedException {
try (HttpClient httpClient = HttpClient.newBuilder()
.connectTimeout(TIMEOUT)
@@ -219,9 +270,20 @@ class StandardServerProviderTest {
assertRedirectRequestsCompleted(httpClient, localhostUri);
assertBadRequestsCompleted(httpClient, localhostUri);
assertMisdirectedRequestsCompleted(httpClient, localhostUri);
+
+ assertReplicatedRequestCompleted(httpClient, localhostUri,
HttpStatus.MOVED_TEMPORARILY_302);
}
}
+ void assertReplicatedRequestCompleted(final HttpClient httpClient, final
URI localhostUri, final int statusCodeExpected) throws IOException,
InterruptedException {
+ final HttpRequest proxyHostRequestReplicatedRequest =
HttpRequest.newBuilder(localhostUri)
+ .version(HttpClient.Version.HTTP_1_1)
+ .header(ProxyHeader.PROXY_HOST.getHeader(),
PUBLIC_UNKNOWN_HOST)
+ .header(ReplicationHeader.REQUEST_REPLICATED.getHeader(),
Boolean.TRUE.toString())
+ .build();
+ assertResponseStatusCode(httpClient,
proxyHostRequestReplicatedRequest, statusCodeExpected);
+ }
+
void assertFrontendRedirectRequestsCompleted(final HttpClient httpClient,
final URI localhostUri) throws IOException, InterruptedException {
final HttpRequest localhostRequest =
HttpRequest.newBuilder(localhostUri)
.version(HttpClient.Version.HTTP_2)
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ApplicationResource.java
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ApplicationResource.java
index 05ecbcf7431..1f6dbc13bd9 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ApplicationResource.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ApplicationResource.java
@@ -42,6 +42,7 @@ import org.apache.nifi.authorization.resource.Authorizable;
import org.apache.nifi.authorization.user.NiFiUser;
import org.apache.nifi.authorization.user.NiFiUserUtils;
import org.apache.nifi.cluster.coordination.ClusterCoordinator;
+import org.apache.nifi.cluster.coordination.http.ReplicationHeader;
import
org.apache.nifi.cluster.coordination.http.replication.RequestReplicationHeader;
import org.apache.nifi.cluster.coordination.http.replication.RequestReplicator;
import org.apache.nifi.cluster.coordination.node.NodeConnectionState;
@@ -388,7 +389,7 @@ public abstract class ApplicationResource {
// Check if the replicated header is set. If so, the request has
already been replicated,
// so we need to service the request locally. If not, then replicate
the request to the entire cluster.
- final String header =
httpServletRequest.getHeader(RequestReplicationHeader.REQUEST_REPLICATED.getHeader());
+ final String header =
httpServletRequest.getHeader(ReplicationHeader.REQUEST_REPLICATED.getHeader());
return header == null;
}
