[
https://issues.apache.org/jira/browse/HADOOP-15457?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16472469#comment-16472469
]
Kanwaljeet Sachdev commented on HADOOP-15457:
---------------------------------------------
[~snemeth]
# Sure, will make it private. Most other introduced constants are in use in
Test file so they were left as non-private. We currently do not have this in
the test so can be made private
# I will also make this private. However, there is already a constant by the
name you suggest. And also, since this gets compiled, I was treating it more
like a private data member but again it is static final and almost like a
constant, so I can make it follow the convention with a slightly different name
if you want so. Let me know and I will change it accordingly and upload a new
patch
> Add Security-Related HTTP Response Header in Yarn WEBUIs.
> ---------------------------------------------------------
>
> Key: HADOOP-15457
> URL: https://issues.apache.org/jira/browse/HADOOP-15457
> Project: Hadoop Common
> Issue Type: Improvement
> Reporter: Kanwaljeet Sachdev
> Assignee: Kanwaljeet Sachdev
> Priority: Major
> Labels: security
> Attachments: HADOOP-15457.001.patch, YARN-8198.001.patch,
> YARN-8198.002.patch, YARN-8198.003.patch, YARN-8198.004.patch,
> YARN-8198.005.patch
>
>
> As of today, YARN web-ui lacks certain security related http response
> headers. We are planning to add few default ones and also add support for
> headers to be able to get added via xml config. Planning to make the below
> two as default.
> * X-XSS-Protection: 1; mode=block
> * X-Content-Type-Options: nosniff
>
> Support for headers via config properties in core-site.xml will be along the
> below lines
> {code:java}
> <property>
> <name>hadoop.http.header.Strict_Transport_Security</name>
> <value>valHSTSFromXML</value>
> </property>{code}
>
> A regex matcher will lift these properties and add into the response header
> when Jetty prepares the response.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
