Nflrijal commented on PR #57549: URL: https://github.com/apache/spark/pull/57549#issuecomment-5155680209
Hi @dongjoon-hyun, Thank you for pointing that out! I will update the PR description text to remove item #2 (UIUtils.prependBaseUri). To address your question regarding the standard use case when spark.ui.reverseProxy=true is set consistently across Master, Worker, and Driver (App): This patch is still necessary for two critical reasons in the standard Standalone cluster setup: 1. X-Forwarded-Context Header Propagation (Fixes Tab Navigation Links): Even when spark.ui.reverseProxy=true is enabled on both Master and Driver, Jetty's ProxyServlet in JettyUtils.createProxyHandler does not automatically attach the X-Forwarded-Context header to proxied requests. As a result, when Master proxies HTTP requests to Driver UI (/proxy/app-XXXX/), Driver UI does not receive its proxy base path (/proxy/app-XXXX). When rendering HTML tab links, Driver UI strips /proxy/app-XXXX and generates links to root (e.g. /jobs/ instead of /proxy/app-XXXX/jobs/). Overriding addProxyHeaders in JettyUtils.createProxyHandler ensures X-Forwarded-Context: /proxy/app-XXXX is forwarded to Driver UI. 2. CSP Nonce Header Conflict (Fixes Event Timeline & Inline Scripts): Master runs HttpSecurityFilter, which attaches Master's own CSP header (Content-Security-Policy: script-src 'nonce-MASTER_NONCE'). However, Driver UI returns HTML with inline scripts signed with Driver's own generated nonce (<script nonce="DRIVER_NONCE">). Because Master attaches its CSP nonce header onto the proxied response, browsers detect a mismatch and block interactive UI scripts such as Event Timeline. Updating HttpSecurityFilter (val isProxyRequest = hreq.getContextPath == "/proxy") skips Master's CSP header for proxied requests so Driver's inline scripts execute correctly. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
