[jira] [Assigned] (KAFKA-21113) Connect admin listener does not apply response.http.headers.config

["Ashwin Pankaj (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KAFKA-21113?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ashwin Pankaj reassigned KAFKA-21113:
-------------------------------------

    Assignee: Ashwin Pankaj

> Connect admin listener does not apply response.http.headers.config
> ------------------------------------------------------------------
>
>                 Key: KAFKA-21113
>                 URL: https://issues.apache.org/jira/browse/KAFKA-21113
>             Project: Kafka
>          Issue Type: Bug
>          Components: connect
>            Reporter: Ashwin Pankaj
>            Assignee: Ashwin Pankaj
>            Priority: Minor
>
> RestServer.initializeResources() builds a separate ServletContextHandler adminContext whenever admin.listeners is configured to a value distinct from listeners. However, configureHttpResponseHeaderFilter(...), which applies response.http.headers.config, is only ever called on the regular context:
> {{String headerConfig = config.responseHeaders();}}
> {{if (!Utils.isBlank(headerConfig)) {}}
> {{    configureHttpResponseHeaderFilter(context, headerConfig);}}
> {{}}}
> response.http.headers.config is commonly used to set security-hardening response headers — the existing test suite (ConnectRestServerTest.testValidCustomizedHttpResponseHeaders) itself uses X-XSS-Protection and Cache-Control as examples, and X-Frame-Options is referenced elsewhere in the same test file. When a distinct admin.listeners is configured, none of these configured headers are applied to admin endpoint responses (e.g. /admin/loggers) — only to the regular listener.
> This is the same class of bug already fixed for REST extension registration in apache/kafka#23150 ("Refactor REST extension registration"), which added a configureExtensions(resourceConfig, adminResourceConfig) hook because registerRestExtensions had the identical "regular-only, admin left out" gap. configureHttpResponseHeaderFilter was missed in that pass.
> Proposed fix: call configureHttpResponseHeaderFilter(adminContext, headerConfig) too, guarded on adminContext != null (mirroring the guard already used for adminContext.start() and extension registration in the same method). Add test coverage asserting the configured headers are present on server.adminUrl() responses when a distinct admin listener is configured.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)