You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "ASF subversion and git services (Jira)" <ji...@apache.org> on 2021/05/01 03:32:00 UTC
[jira] [Commented] (NIFI-7870) Fix anonymous access control for
advanced UI resources
[ https://issues.apache.org/jira/browse/NIFI-7870?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17337717#comment-17337717 ]
ASF subversion and git services commented on NIFI-7870:
-------------------------------------------------------
Commit 1090a9748a8ce5fe21d5a79d85a46858f1288f85 in nifi's branch refs/heads/main from Nathan Gough
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=1090a97 ]
NIFI-7870 Resolved access to extension resources when using JWT
- Added SameSite Session Cookie __Host-Authorization-Bearer for sending JWT
- Configured Spring Security CSRF Filter comparing Authorization header and Cookie JWT
- Implemented BearerTokenResolver for retrieving JWT
This closes #4988
Signed-off-by: David Handermann <ex...@apache.org>
> Fix anonymous access control for advanced UI resources
> ------------------------------------------------------
>
> Key: NIFI-7870
> URL: https://issues.apache.org/jira/browse/NIFI-7870
> Project: Apache NiFi
> Issue Type: Bug
> Components: Core UI
> Affects Versions: 1.12.0, 1.12.1
> Reporter: Nathan Gough
> Assignee: Nathan Gough
> Priority: Critical
> Labels: UI, content-type, header, security
> Time Spent: 5h 20m
> Remaining Estimate: 0h
>
> -The X-Content-Type header was added in NiFi 1.12.0, which blocks resources in the browser if they do not have the content type added. It appears that some 'advanced UI' resources do not have the content type applied to their resources and are blocked from loading.-
> On further inspection, it appears that explicitly disallowing anonymous access has resulted in some static resources in the NiFi advanced UI's WAR checking whether the anonymous user should be able to access them. The anonymous access was intended to be used on the NiFi API endpoints, and not static resources.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)