You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hbase.apache.org by zh...@apache.org on 2024/10/26 14:06:13 UTC
(hbase) 01/02: Revert "HBASE-23303 Add default security headers if SSL is enabled (#4128)"
This is an automated email from the ASF dual-hosted git repository.
zhangduo pushed a commit to branch branch-3
in repository https://gitbox.apache.org/repos/asf/hbase.git
commit 6ddfcfd48385e892df0052f4a4eabd3aae71328a
Author: Duo Zhang <zh...@apache.org>
AuthorDate: Sat Oct 26 21:51:55 2024 +0800
Revert "HBASE-23303 Add default security headers if SSL is enabled (#4128)"
This reverts commit 87f8d9ac4e1ed9f7f31eb51208f15e37a68473a1.
---
.../java/org/apache/hadoop/hbase/http/HttpServer.java | 7 +++----
.../apache/hadoop/hbase/http/SecurityHeadersFilter.java | 17 ++++++++++-------
.../org/apache/hadoop/hbase/http/TestSSLHttpServer.java | 14 --------------
.../java/org/apache/hadoop/hbase/rest/RESTServer.java | 6 ++----
.../org/apache/hadoop/hbase/rest/TestRESTServerSSL.java | 7 +------
5 files changed, 16 insertions(+), 35 deletions(-)
diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
index d5af8df1c7f..91e7cac6ea7 100644
--- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
+++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java
@@ -639,10 +639,9 @@ public class HttpServer implements FilterContainer {
addGlobalFilter("clickjackingprevention", ClickjackingPreventionFilter.class.getName(),
ClickjackingPreventionFilter.getDefaultParameters(conf));
- HttpConfig httpConfig = new HttpConfig(conf);
-
- addGlobalFilter("securityheaders", SecurityHeadersFilter.class.getName(),
- SecurityHeadersFilter.getDefaultParameters(conf, httpConfig.isSecure()));
+ addGlobalFilter("securityheaders",
+ SecurityHeadersFilter.class.getName(),
+ SecurityHeadersFilter.getDefaultParameters(conf));
// But security needs to be enabled prior to adding the other servlets
if (authenticationEnabled) {
diff --git a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java
index 01c8a32c62a..a02e9a92126 100644
--- a/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java
+++ b/hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java
@@ -36,10 +36,11 @@ import org.slf4j.LoggerFactory;
@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.CONFIG)
public class SecurityHeadersFilter implements Filter {
- private static final Logger LOG = LoggerFactory.getLogger(SecurityHeadersFilter.class);
- private static final String DEFAULT_HSTS = "max-age=63072000;includeSubDomains;preload";
- private static final String DEFAULT_CSP =
- "default-src https: data: 'unsafe-inline' 'unsafe-eval'";
+
+ private static final Logger LOG =
+ LoggerFactory.getLogger(SecurityHeadersFilter.class);
+ private static final String DEFAULT_HSTS = "";
+ private static final String DEFAULT_CSP = "";
private FilterConfig filterConfig;
@Override
@@ -69,10 +70,12 @@ public class SecurityHeadersFilter implements Filter {
public void destroy() {
}
- public static Map<String, String> getDefaultParameters(Configuration conf, boolean isSecure) {
+ public static Map<String, String> getDefaultParameters(Configuration conf) {
Map<String, String> params = new HashMap<>();
- params.put("hsts", conf.get("hbase.http.filter.hsts.value", isSecure ? DEFAULT_HSTS : ""));
- params.put("csp", conf.get("hbase.http.filter.csp.value", isSecure ? DEFAULT_CSP : ""));
+ params.put("hsts", conf.get("hbase.http.filter.hsts.value",
+ DEFAULT_HSTS));
+ params.put("csp", conf.get("hbase.http.filter.csp.value",
+ DEFAULT_CSP));
return params;
}
}
diff --git a/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java
index 41dc2c093d0..91251f6a966 100644
--- a/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java
+++ b/hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestSSLHttpServer.java
@@ -21,11 +21,9 @@ import static org.junit.Assert.assertEquals;
import java.io.ByteArrayOutputStream;
import java.io.File;
-import java.io.IOException;
import java.io.InputStream;
import java.net.URI;
import java.net.URL;
-import java.security.GeneralSecurityException;
import javax.net.ssl.HttpsURLConnection;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.FileUtil;
@@ -73,7 +71,6 @@ public class TestSSLHttpServer extends HttpServerFunctionalTest {
serverConf = HTU.getConfiguration();
serverConf.setInt(HttpServer.HTTP_MAX_THREADS, TestHttpServer.MAX_THREADS);
- serverConf.setBoolean(ServerConfigurationKeys.HBASE_SSL_ENABLED_KEY, true);
keystoresDir = new File(HTU.getDataTestDir("keystore").toString());
keystoresDir.mkdirs();
@@ -120,17 +117,6 @@ public class TestSSLHttpServer extends HttpServerFunctionalTest {
assertEquals("a:b\nc<:d\ne:>\n", readOut(new URL(baseUrl, "/echo?a=b&c<=d&e=>")));
}
- @Test
- public void testSecurityHeaders() throws IOException, GeneralSecurityException {
- HttpsURLConnection conn = (HttpsURLConnection) baseUrl.openConnection();
- conn.setSSLSocketFactory(clientSslFactory.createSSLSocketFactory());
- assertEquals(HttpsURLConnection.HTTP_OK, conn.getResponseCode());
- assertEquals("max-age=63072000;includeSubDomains;preload",
- conn.getHeaderField("Strict-Transport-Security"));
- assertEquals("default-src https: data: 'unsafe-inline' 'unsafe-eval'",
- conn.getHeaderField("Content-Security-Policy"));
- }
-
private static String readOut(URL url) throws Exception {
HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
conn.setSSLSocketFactory(clientSslFactory.createSSLSocketFactory());
diff --git a/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java b/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java
index 760f2ca8b41..4b707fd13a2 100644
--- a/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java
+++ b/hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java
@@ -288,9 +288,7 @@ public class RESTServer implements Constants {
httpConfig.setSendDateHeader(false);
ServerConnector serverConnector;
- boolean isSecure = false;
if (conf.getBoolean(REST_SSL_ENABLED, false)) {
- isSecure = true;
HttpConfiguration httpsConfig = new HttpConfiguration(httpConfig);
httpsConfig.addCustomizer(new SecureRequestCustomizer());
@@ -377,8 +375,8 @@ public class RESTServer implements Constants {
ctxHandler.addFilter(filter, PATH_SPEC_ANY, EnumSet.of(DispatcherType.REQUEST));
}
addCSRFFilter(ctxHandler, conf);
- HttpServerUtil.addClickjackingPreventionFilter(ctxHandler, conf, PATH_SPEC_ANY);
- HttpServerUtil.addSecurityHeadersFilter(ctxHandler, conf, isSecure, PATH_SPEC_ANY);
+ HttpServerUtil.addClickjackingPreventionFilter(ctxHandler, conf);
+ HttpServerUtil.addSecurityHeadersFilter(ctxHandler, conf);
HttpServerUtil.constrainHttpMethods(ctxHandler, servlet.getConfiguration()
.getBoolean(REST_HTTP_ALLOW_OPTIONS_METHOD, REST_HTTP_ALLOW_OPTIONS_METHOD_DEFAULT));
diff --git a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java
index f4bce03abca..da6dea2f4ad 100644
--- a/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java
+++ b/hbase-rest/src/test/java/org/apache/hadoop/hbase/rest/TestRESTServerSSL.java
@@ -24,6 +24,7 @@ import java.lang.reflect.Method;
import java.security.KeyPair;
import java.security.cert.X509Certificate;
import java.util.Optional;
+
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.hbase.HBaseClassTestRule;
import org.apache.hadoop.hbase.HBaseTestingUtil;
@@ -121,12 +122,6 @@ public class TestRESTServerSSL {
Response response = sslClient.get("/version", Constants.MIMETYPE_TEXT);
assertEquals(200, response.getCode());
-
- // Default security headers
- assertEquals("max-age=63072000;includeSubDomains;preload",
- response.getHeader("Strict-Transport-Security"));
- assertEquals("default-src https: data: 'unsafe-inline' 'unsafe-eval'",
- response.getHeader("Content-Security-Policy"));
}
@Test(expected = org.apache.http.client.ClientProtocolException.class)