holdenk opened a new pull request, #59034: URL: https://github.com/apache/spark/pull/59034
### What changes were proposed in this pull request? Make more side-effect causing behavior in the Spark Web UI POST v.s. GET/HEAD when not deployed on YARN. Also validate that the requests have a CSRF token. Even in YARN deployments GETs which have pre-fetch headers (`x-moz`: `prefecth`) will be rejected with 403. `app/kill`, `driver/kill`, `app/hold`, `app/resume` all require CSRF tokens now, however `worker/kill` does not as it is an exposed API for operators. Missing CSRF tokens will 403 & a HEAD/GET request will 405 unless deployed on YARN or fallback behavior is explicitly enabled. Backport of c4ef97169fffaa4fc71410da3cf2c3510693dd27 ### Why are the changes needed? Browser pre-fetch and agents making assumptions on POST v.s. GET "verbs." In general GETs should be side-effect free which is why things like crawlers browsers and agents may choose to prefect them which when the GET is not side-effect free causes undesired behavior. ### Does this PR introduce _any_ user-facing change? Yes new config flag, also pressing back on POST pages often behaves differently in browsers. ### How was this patch tested? New UI test, both "regular" in MasterWebUISuite and UISuite but also added additional selenium tests. Existing UI tests still function :) ### Was this patch authored or co-authored using generative AI tooling? Generated-By: Claude (mixutre of models) and Cursor (Kimi K3) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
