David Handermann created NIFI-16510:
---------------------------------------
Summary: Honor Sec-Fetch-Site on state-changing REST requests
Key: NIFI-16510
URL: https://issues.apache.org/jira/browse/NIFI-16510
Project: Apache NiFi
Issue Type: Improvement
Components: Core Framework
Reporter: David Handermann
Assignee: David Handermann
Supported browsers send {{Sec-Fetch-Site}} on HTTPS requests, and application
code cannot change or omit it. With application support targeting modern
browsers, a new filter should be implemented to reject POST, PUT, PATCH, and
DELETE requests when the header value is {{cross-site}}. Other values or a
missing header should be allowed so cluster replication and
certificate-authenticated API clients continue to work unchanged.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
