prasanthj commented on a change in pull request #678: HIVE-21892: Trusted
domain authentication should look at X-Forwarded-For header as well
URL: https://github.com/apache/hive/pull/678#discussion_r295548052
##########
File path: common/src/java/org/apache/hadoop/hive/conf/HiveConf.java
##########
@@ -3486,6 +3486,13 @@ private static void
populateLlapDaemonVarsSet(Set<String> llapDaemonVarsSetLocal
" it is empty, which means that all the connections to HiveServer2 are
authenticated. " +
"When it is non-empty, the client has to provide a Hive user name. Any
password, if " +
"provided, will not be used when authentication is skipped."),
+
HIVE_SERVER2_TRUSTED_DOMAIN_USE_XFF_HEADER("hive.server2.trusted.domain.use.xff.header",
false,
Review comment:
adding it by default will let clients spoof with XFF headers and some
proxies might now sanitize it correctly. In most cases, proxies will use the
client's ip to connect to HS2 (reverse proxies) in which case we can just use
request.getRemoteHost() and not rely on XFF.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
