Ashwin Pankaj created KAFKA-21113:
-------------------------------------
Summary: Connect admin listener does not apply
response.http.headers.config
Key: KAFKA-21113
URL: https://issues.apache.org/jira/browse/KAFKA-21113
Project: Kafka
Issue Type: Bug
Components: connect
Reporter: Ashwin Pankaj
RestServer.initializeResources() builds a separate ServletContextHandler
adminContext whenever admin.listeners is configured to a value distinct from
listeners. However, configureHttpResponseHeaderFilter(...), which applies
response.http.headers.config, is only ever called on the regular context:
{{String headerConfig = config.responseHeaders();}}
{{if (!Utils.isBlank(headerConfig)) {}}
{{ configureHttpResponseHeaderFilter(context, headerConfig);}}
{{}}}
response.http.headers.config is commonly used to set security-hardening
response headers — the existing test suite
(ConnectRestServerTest.testValidCustomizedHttpResponseHeaders) itself uses
X-XSS-Protection and Cache-Control as examples, and X-Frame-Options is
referenced elsewhere in the same test file. When a distinct admin.listeners is
configured, none of these configured headers are applied to admin endpoint
responses (e.g. /admin/loggers) — only to the regular listener.
This is the same class of bug already fixed for REST extension registration in
apache/kafka#23150 ("Refactor REST extension registration"), which added a
configureExtensions(resourceConfig, adminResourceConfig) hook because
registerRestExtensions had the identical "regular-only, admin left out" gap.
configureHttpResponseHeaderFilter was missed in that pass.
Proposed fix: call configureHttpResponseHeaderFilter(adminContext,
headerConfig) too, guarded on adminContext != null (mirroring the guard already
used for adminContext.start() and extension registration in the same method).
Add test coverage asserting the configured headers are present on
server.adminUrl() responses when a distinct admin listener is configured.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
