abstractdog commented on code in PR #528:
URL: https://github.com/apache/tez/pull/528#discussion_r3620944128
##########
tez-dag/src/main/java/org/apache/tez/dag/app/web/AMWebController.java:
##########
@@ -135,24 +135,26 @@ static String encodeHeader(final String header) {
public void setCorsHeaders() {
final HttpServletResponse res = response();
- /*
- * ideally the Origin and other CORS headers should be checked and
response headers set only
- * if it matches the allowed origins. however rm does not forward these
headers.
- */
String historyUrlBase =
appContext.getAMConf().get(TezConfiguration.TEZ_HISTORY_URL_BASE, "");
- String origin = request().getHeader(ORIGIN);
- if(origin == null) {
+ String trustedOrigin = null;
+ if (!historyUrlBase.isEmpty()) {
try {
URL url = URI.create(historyUrlBase).toURL();
- origin = url.getProtocol() + "://" + url.getAuthority();
+ trustedOrigin = url.getProtocol() + "://" + url.getAuthority();
} catch (IllegalArgumentException | MalformedURLException e) {
LOG.debug("Invalid url set for tez history url base: {}",
historyUrlBase, e);
}
}
Review Comment:
maybe refactor this to a method that derives the origin or returns null
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
