[
https://issues.apache.org/jira/browse/KAFKA-21113?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ashwin Pankaj reassigned KAFKA-21113:
-------------------------------------
Assignee: Ashwin Pankaj
> Connect admin listener does not apply response.http.headers.config
> ------------------------------------------------------------------
>
> Key: KAFKA-21113
> URL: https://issues.apache.org/jira/browse/KAFKA-21113
> Project: Kafka
> Issue Type: Bug
> Components: connect
> Reporter: Ashwin Pankaj
> Assignee: Ashwin Pankaj
> Priority: Minor
>
> RestServer.initializeResources() builds a separate ServletContextHandler
> adminContext whenever admin.listeners is configured to a value distinct from
> listeners. However, configureHttpResponseHeaderFilter(...), which applies
> response.http.headers.config, is only ever called on the regular context:
> {{String headerConfig = config.responseHeaders();}}
> {{if (!Utils.isBlank(headerConfig)) {}}
> {{ configureHttpResponseHeaderFilter(context, headerConfig);}}
> {{}}}
> response.http.headers.config is commonly used to set security-hardening
> response headers — the existing test suite
> (ConnectRestServerTest.testValidCustomizedHttpResponseHeaders) itself uses
> X-XSS-Protection and Cache-Control as examples, and X-Frame-Options is
> referenced elsewhere in the same test file. When a distinct admin.listeners
> is configured, none of these configured headers are applied to admin endpoint
> responses (e.g. /admin/loggers) — only to the regular listener.
> This is the same class of bug already fixed for REST extension registration
> in apache/kafka#23150 ("Refactor REST extension registration"), which added a
> configureExtensions(resourceConfig, adminResourceConfig) hook because
> registerRestExtensions had the identical "regular-only, admin left out" gap.
> configureHttpResponseHeaderFilter was missed in that pass.
> Proposed fix: call configureHttpResponseHeaderFilter(adminContext,
> headerConfig) too, guarded on adminContext != null (mirroring the guard
> already used for adminContext.start() and extension registration in the same
> method). Add test coverage asserting the configured headers are present on
> server.adminUrl() responses when a distinct admin listener is configured.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
