HBASE-23303 Add security headers to REST server/info page

hbase-http/src/main/java/org/apache/hadoop/hbase/http/HttpServer.java

@@ -596,10 +596,11 @@ private void initializeWebServer(String name, String hostName,
     addDefaultApps(contexts, appDir, conf);
 
     addGlobalFilter("safety", QuotingInputFilter.class.getName(), null);
-    Map<String, String> params = new HashMap<>();
-    params.put("xframeoptions", conf.get("hbase.http.filter.xframeoptions.mode", "DENY"));
-    addGlobalFilter("clickjackingprevention",
-            ClickjackingPreventionFilter.class.getName(), params);
+
+    Map<String, String> params = SecurityHeadersFilter.getDefaultParameters(conf);
+    addGlobalFilter("securityheaders",
+            SecurityHeadersFilter.class.getName(), params);
+
     final FilterInitializer[] initializers = getFilterInitializers(conf);
     if (initializers != null) {
       conf = new Configuration(conf);

hbase-http/src/main/java/org/apache/hadoop/hbase/http/SecurityHeadersFilter.java

@@ -0,0 +1,83 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hadoop.hbase.http;
+
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.hbase.HBaseInterfaceAudience;
+import org.apache.yetus.audience.InterfaceAudience;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+@InterfaceAudience.LimitedPrivate(HBaseInterfaceAudience.CONFIG)
+public class SecurityHeadersFilter implements Filter {
+  private static final Logger LOG =
+      LoggerFactory.getLogger(SecurityHeadersFilter.class);
+  private static final String DEFAULT_XFRAMEOPTIONS = "DENY";
+  private static final String DEFAULT_HSTS = "max-age=63072000;includeSubDomains;preload";
+  private static final String DEFAULT_CSP =
+      "default-src https: data: 'unsafe-inline' 'unsafe-eval'";
+  private FilterConfig filterConfig;
+
+  @Override
+  public void init(FilterConfig filterConfig) throws ServletException {
+    this.filterConfig = filterConfig;
+    LOG.info("Added security headers filter");
+  }
+
+  @Override
+  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+      throws IOException, ServletException {
+    HttpServletResponse httpResponse = (HttpServletResponse) response;
+    httpResponse.addHeader("X-Content-Type-Options", "nosniff");
+    httpResponse.addHeader("X-XSS-Protection", "1; mode=block");
+    httpResponse.addHeader("X-Frame-Options",
+        filterConfig.getInitParameter("xframeoptions"));
+    httpResponse.addHeader("Strict-Transport-Security",
+        filterConfig.getInitParameter("hsts"));
+    httpResponse.addHeader("Content-Security-Policy",
+        filterConfig.getInitParameter("csp"));
+    chain.doFilter(request, response);
+  }
+
+  @Override
+  public void destroy() {
+  }
+
+  public static Map<String, String> getDefaultParameters(Configuration conf) {
+    Map<String, String> params = new HashMap<>();
+    params.put("xframeoptions", conf.get("hbase.http.filter.xframeoptions.mode",
+        DEFAULT_XFRAMEOPTIONS));
+    params.put("hsts", conf.get("hbase.http.filter.hsts.value",
+        DEFAULT_HSTS));
+    params.put("csp", conf.get("hbase.http.filter.csp.value",
+        DEFAULT_CSP));
+    return params;
+  }
+}

hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/RESTServer.java

@@ -20,13 +20,14 @@
 
 import java.lang.management.ManagementFactory;
 import java.util.ArrayList;
+import java.util.EnumSet;
 import java.util.List;
 import java.util.Map;
-import java.util.EnumSet;
 import java.util.concurrent.ArrayBlockingQueue;
 
 import com.fasterxml.jackson.jaxrs.json.JacksonJaxbJsonProvider;
 import org.apache.commons.lang3.ArrayUtils;
+import org.apache.hadoop.hbase.http.SecurityHeadersFilter;
 import org.apache.yetus.audience.InterfaceAudience;
 import org.apache.hadoop.conf.Configuration;
 import org.apache.hadoop.hbase.HBaseConfiguration;
@@ -137,6 +138,15 @@ void addCSRFFilter(ServletContextHandler ctxHandler, Configuration conf) {
     }
   }
 
+  private void addSecurityHeadersFilter(ServletContextHandler ctxHandler, Configuration conf) {
+    FilterHolder holder = new FilterHolder();
+    holder.setName("security");
+    holder.setClassName(SecurityHeadersFilter.class.getName());
+    Map<String, String> params = SecurityHeadersFilter.getDefaultParameters(conf);
+    holder.setInitParameters(params);
+    ctxHandler.addFilter(holder, PATH_SPEC_ANY, EnumSet.allOf(DispatcherType.class));
+  }
+
   // login the server principal (if using secure Hadoop)
   private static Pair<FilterHolder, Class<? extends ServletContainer>> loginServerPrincipal(
     UserProvider userProvider, Configuration conf) throws Exception {
@@ -349,6 +359,7 @@ public synchronized void run() throws Exception {
       ctxHandler.addFilter(filter, PATH_SPEC_ANY, EnumSet.of(DispatcherType.REQUEST));
     }
     addCSRFFilter(ctxHandler, conf);
+    addSecurityHeadersFilter(ctxHandler, conf);
     HttpServerUtil.constrainHttpMethods(ctxHandler, servlet.getConfiguration()
         .getBoolean(REST_HTTP_ALLOW_OPTIONS_METHOD, REST_HTTP_ALLOW_OPTIONS_METHOD_DEFAULT));