You are viewing a plain text version of this content. The canonical link for it is here.

Posted to yarn-issues@hadoop.apache.org by "ASF GitHub Bot (Jira)" <ji...@apache.org> on 2026/01/23 06:53:00 UTC

[jira] [Updated] (YARN-11923) YARN web proxy AmIpFilter allows TRACE, bypassing sparkUI TRACE block

     [ https://issues.apache.org/jira/browse/YARN-11923?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

ASF GitHub Bot updated YARN-11923:
----------------------------------
    Labels: pull-request-available  (was: )

> YARN web proxy AmIpFilter allows TRACE, bypassing sparkUI TRACE block
> ---------------------------------------------------------------------
>
>                 Key: YARN-11923
>                 URL: https://issues.apache.org/jira/browse/YARN-11923
>             Project: Hadoop YARN
>          Issue Type: Bug
>          Components: yarn
>            Reporter: Susheel Gupta
>            Assignee: Susheel Gupta
>            Priority: Major
>              Labels: pull-request-available
>
> In yarn mode, sparkUI responds to http TRACE with 302 redirect. The redirect happens in AmIpFilter, so the TRACE request is getting processed before spark jetty handler can reject it. This causes security scanners to report TRACE enabled.
> In local mode there is no yarn proxy filter, so requests go directly to spark Jetty servlet. SPARK‑5983 adds TRACE filter correctly returning 405.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org