[
https://issues.apache.org/jira/browse/SPARK-6846?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14523693#comment-14523693
]
Sean Owen commented on SPARK-6846:
----------------------------------
OK, this had to be partially backed out, since the YARN AM proxy that sits in
front of the UI won't proxy a POST! The standalone services are unaffected. So,
it unfortunately needs to use GET. It's the lesser of two evils.
> Stage kill URL easy to accidentally trigger and possibility for security
> issue.
> -------------------------------------------------------------------------------
>
> Key: SPARK-6846
> URL: https://issues.apache.org/jira/browse/SPARK-6846
> Project: Spark
> Issue Type: Improvement
> Components: Web UI
> Affects Versions: 1.3.0
> Reporter: Dev Lakhani
> Assignee: Sean Owen
> Priority: Minor
> Fix For: 1.4.0
>
>
> On a similar note: When the kill link is cached in the browser bar, it's easy
> to accidentally kill a job just by pressing enter. For example:
> You press the kill stage button and get the prompt whether you want to kill
> the stage. You launch a new job and start typing:
> http://localhost:4040/
> Chrome for example starts auto completing with
> http://localhost:4040/stages/kill/?id=0&terminate=true
> If you accidentally press enter it will kill the current stage without any
> prompts.
> I think its also a bit of a security issue if from any host you can
> curl/wget/issue: http://localhost:4040/stages/kill/?id=0&terminate=true and
> it will kill the current stage without prompting.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
