[
https://issues.apache.org/jira/browse/NIFI-14115?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17908531#comment-17908531
]
ASF subversion and git services commented on NIFI-14115:
--------------------------------------------------------
Commit 5f72313003fe8b0142657892ebd94bfee2a053d4 in nifi's branch
refs/heads/main from David Handermann
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=5f72313003 ]
NIFI-14115 Set Standard HTTP Headers for Framework Responses
This closes #9598
- Added HeaderWriterHandler implementing Jetty Handler methods for setting
standard HTTP response headers
- Removed HeaderWriterFilter approach for writing standard HTTP headers
- Refactored Jetty Server instantiation to StandardServerProvider for
streamlined configuration and testing
- Simplified Server start test method to avoid timing issues
- Removed unnecessary Timeout annotation
Signed-off-by: Joseph Witt <[email protected]>
> Set Standard HTTP Response Headers for All Requests
> ---------------------------------------------------
>
> Key: NIFI-14115
> URL: https://issues.apache.org/jira/browse/NIFI-14115
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Core Framework
> Reporter: David Handermann
> Assignee: David Handermann
> Priority: Minor
> Time Spent: 1h 10m
> Remaining Estimate: 0h
>
> The framework Jetty Server includes standard Servlet Filters to set the
> following HTTP response headers on web application requests:
> * Content-Security-Policy
> * X-Frame-Options
> * Strict-Transport-Security
> * X-XSS-Protection
> The current implementation applies these Filters to all web applications.
> This covers all HTTP requests to the NiFi REST API and user interface
> resources. Jetty serves requests to the root server URL or non-existent paths
> using standard Handlers, which do not use Servlet Filters. The implementation
> approach should be adjusted to use apply these response headers using a Jetty
> Handler, regardless of web application, for consistency across framework HTTP
> responses.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
