You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@nifi.apache.org by "David Handermann (Jira)" <ji...@apache.org> on 2021/05/01 03:34:00 UTC

[jira] [Resolved] (NIFI-7870) Fix anonymous access control for advanced UI resources

     [ https://issues.apache.org/jira/browse/NIFI-7870?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

David Handermann resolved NIFI-7870.
------------------------------------
    Fix Version/s: 1.14.0
       Resolution: Fixed

> Fix anonymous access control for advanced UI resources
> ------------------------------------------------------
>
>                 Key: NIFI-7870
>                 URL: https://issues.apache.org/jira/browse/NIFI-7870
>             Project: Apache NiFi
>          Issue Type: Bug
>          Components: Core UI
>    Affects Versions: 1.12.0, 1.12.1
>            Reporter: Nathan Gough
>            Assignee: Nathan Gough
>            Priority: Critical
>              Labels: UI, content-type, header, security
>             Fix For: 1.14.0
>
>          Time Spent: 5.5h
>  Remaining Estimate: 0h
>
> -The X-Content-Type header was added in NiFi 1.12.0, which blocks resources in the browser if they do not have the content type added. It appears that some 'advanced UI' resources do not have the content type applied to their resources and are blocked from loading.-
> On further inspection, it appears that explicitly disallowing anonymous access has resulted in some static resources in the NiFi advanced UI's WAR checking whether the anonymous user should be able to access them. The anonymous access was intended to be used on the NiFi API endpoints, and not static resources.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)