[
https://issues.apache.org/jira/browse/HADOOP-12234?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14635938#comment-14635938
]
Sean Busbey commented on HADOOP-12234:
--------------------------------------
{quote}
I don't think it makes sense to make it available through a filter due to the
variety requirements of the different projects. A better approach is to change
the HTML code to ensure that the UI runs on the top frame.
{quote}
this seems inefficient, since it requires maintaining the fix on every HTML
page. By far the common case is "I don't expect to be in a frame." Especially
given a known attack vector, we should make folks opt-in to allowing it.
{quote}
oh btw, the implementation is from OWASP(Open Web Application Security Project)
page here.
{quote}
Please update your patch to maintain the original authorship and license header
(see [the source header policy for details, under "third party
works"|http://www.apache.org/legal/src-headers.html]). Also please add the
appropriate addition to the top-level LICENSE.txt file.
> Web UI Framable Page
> --------------------
>
> Key: HADOOP-12234
> URL: https://issues.apache.org/jira/browse/HADOOP-12234
> Project: Hadoop Common
> Issue Type: Bug
> Reporter: Apekshit Sharma
> Assignee: Apekshit Sharma
> Attachments: HADOOP-12234.patch
>
>
> The web UIs do not include the "X-Frame-Options" header to prevent the pages
> from being framed from another site.
> Reference:
> https://www.owasp.org/index.php/Clickjacking
> https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
> https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
