[ 
https://issues.apache.org/jira/browse/YARN-3654?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14545774#comment-14545774
 ] 

Xuan Gong commented on YARN-3654:
---------------------------------

My proposal:
do similar things as YARN-2605, we need to create a NMWebAppFilter, and instead 
of simply adding the meta-refresh in html, we need to set 307 as response code, 
add Location which includes the redirect-url in response header and let the 
browser to handle the re-direction by itself.

> ContainerLogsPage web UI should not have meta-refresh
> -----------------------------------------------------
>
>                 Key: YARN-3654
>                 URL: https://issues.apache.org/jira/browse/YARN-3654
>             Project: Hadoop YARN
>          Issue Type: Bug
>          Components: yarn
>    Affects Versions: 2.7.1
>            Reporter: Xuan Gong
>            Assignee: Xuan Gong
>
> Currently, When we try to find the container logs for the finished 
> application, it will re-direct to the url which we re-configured for 
> yarn.log.server.url in yarn-site.xml. But in ContainerLogsPage, we are using 
> meta-refresh:
> {code}
>         set(TITLE, join("Redirecting to log server for ", $(CONTAINER_ID)));
>         html.meta_http("refresh", "1; url=" + redirectUrl);
> {code}
> which is not good for some browsers which need to enable the meta-refresh in 
> their security setting, especially for IE which meta-refresh is considered a 
> security hole.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Reply via email to