dongjoon-hyun commented on PR #58640:
URL: https://github.com/apache/spark/pull/58640#issuecomment-5733947404
Thank you for addressing the previous comments. I have two remaining
requests.
1. Could you add a migration guide entry to `docs/core-migration-guide.md`?
A new `Upgrading from Core 4.3 to 4.4` section is needed. This PR changes the
behavior of the existing endpoints:
- Outside YARN, `/jobs/job/kill/` and `/stages/stage/kill/` no longer
accept GET by default (405).
- `/jobs/job/kill/`, `/stages/stage/kill/`, and the Master UI's
`/app/kill/` and `/driver/kill/` now return 403 without the per-UI `csrfToken`.
For example, a script calling `curl -X POST <master>/app/kill/ -d
"id=...&terminate=true"` will break.
It would be great to mention that `spark.ui.actionsViaGetEnabled=true`
restores GET, while the token requirement cannot be disabled.
2. The PR description is still outdated. It says "validate that the requests
are coming from the correct origin", but this PR uses a per-UI random token
instead. Could you update it to cover:
- 403 on a missing or invalid token and on prefetch requests, and 405 on
HEAD requests
- the Master UI endpoint changes and why `/workers/kill` is excluded
- the new config `spark.ui.actionsViaGetEnabled` and its YARN-dependent
default
- the test section (`JettyUtilsSuite`, `MasterWebUISuite`,
`UISeleniumSuite`, `UISuite`)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
