HyukjinKwon commented on PR #58599: URL: https://github.com/apache/spark/pull/58599#issuecomment-5584831178
Closing after review. AmIpFilter is always installed first in the AM UI filter chain, so any real authentication filter runs after it and its request wrapper already determines getRemoteUser(); and where no such filter is configured, ignoring the cookie only makes proxied requests anonymous (which still pass the view/modify ACLs). So this option does not add meaningful protection in either deploy mode. A complete solution belongs on the YARN RM web proxy side (signing the forwarded cookie). Closing. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
