Skip to content

[ZEPPELIN-4723] Enable HTTP security headers by default #3716

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
krishna-pandey wants to merge 4 commits into from
Closed

[ZEPPELIN-4723] Enable HTTP security headers by default #3716

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6fbd30e
Enable HTTP security headers by default
Apr 4, 2020
f7578ad
removed HSTS header, requires TLS config for Zeppelin to start
Apr 4, 2020
01d3040
Added documentation for enabled headers with default values
Apr 4, 2020
afde17f
Added default config values
Apr 6, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 2 additions & 10 deletions conf/zeppelin-site.xml.template
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -519,13 +519,11 @@
</property>
-->

<!--
<property>
<name>zeppelin.server.jetty.name</name>
<value>Jetty(7.6.0.v20120127)</value>
<value> </value>
<description>Hardcoding Application Server name to Prevent Fingerprinting</description>
</property>
-->

<!--
<property>
Expand Down Expand Up @@ -565,13 +563,11 @@
</property>
-->

<!--
<property>
<name>zeppelin.server.xframe.options</name>
<value>SAMEORIGIN</value>
<description>The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a frame/iframe/object.</description>
</property>
-->

<!--
<property>
Expand All @@ -580,22 +576,18 @@
<description>The HTTP Strict-Transport-Security response header is a security feature that lets a web site tell browsers that it should only be communicated with using HTTPS, instead of using HTTP. Enable this when Zeppelin is running on HTTPS. Value is in Seconds, the default value is equivalent to 20 years.</description>
</property>
-->
<!--

<property>
<name>zeppelin.server.xxss.protection</name>
<value>1</value>
<value>1; mode=block</value>
<description>The HTTP X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. When value is set to 1 and a cross-site scripting attack is detected, the browser will sanitize the page (remove the unsafe parts).</description>
</property>
-->

<!--
<property>
<name>zeppelin.server.xcontent.type.options</name>
<value>nosniff</value>
<description>The HTTP X-Content-Type-Options response header helps to prevent MIME type sniffing attacks. It directs the browser to honor the type specified in the Content-Type header, rather than trying to determine the type from the content itself. The default value "nosniff" is really the only meaningful value. This header is supported on all browsers except Safari and Safari on iOS.</description>
</property>
-->

<!--
<property>
Expand Down
16 changes: 8 additions & 8 deletions docs/setup/security/http_security_headers.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ Read more about HSTS [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/He

The HTTP X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari Web browsers that initiates configured action when they detect reflected cross-site scripting (XSS) attacks.

The following property needs to be updated in the zeppelin-site.xml in order to set X-XSS-PROTECTION header.
The below property to set X-XSS-Protection header is enabled with default value of "1; mode=block" in the zeppelin-site.xml

```xml
<property>
Expand All @@ -64,7 +64,7 @@ The following property needs to be updated in the zeppelin-site.xml in order to
```


You can choose appropriate value from below.
You can choose appropriate value from below to update the configuration if required.

* 0 (Disables XSS filtering)
* 1 (Enables XSS filtering. If a cross-site scripting attack is detected, the browser will sanitize the page.)
Expand All @@ -76,7 +76,7 @@ Read more about HTTP X-XSS-Protection response header [here](https://developer.m

The X-Frame-Options HTTP response header can indicate browser to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites in a `<frame>`,`<iframe>` or `<object>`.

The following property needs to be updated in the zeppelin-site.xml in order to set X-Frame-Options header.
The below property to set X-Frame-Options header is enabled with default value of "SAMEORIGIN" in the zeppelin-site.xml

```xml
<property>
Expand All @@ -87,7 +87,7 @@ The following property needs to be updated in the zeppelin-site.xml in order to
```


You can choose appropriate value from below.
You can choose appropriate value from below to update the configuration if required.

* `DENY`
* `SAMEORIGIN`
Expand All @@ -97,7 +97,7 @@ You can choose appropriate value from below.

The HTTP X-Content-Type-Options response header helps to prevent MIME type sniffing attacks. It directs the browser to honor the type specified in the Content-Type header, rather than trying to determine the type from the content itself. The default value `nosniff` is really the only meaningful value. This header is supported on all browsers except Safari and Safari on iOS.

Zeppelin server will add this header to HTTP response by default. The following property needs to be updated in the zeppelin-site.xml in order to change X-Content-Type-Options header value.
The below property to set X-Content-Type-Options header is enabled with default value of "nosniff" in the zeppelin-site.xml

```xml
<property>
Expand All @@ -111,14 +111,14 @@ Zeppelin server will add this header to HTTP response by default. The following

Security conscious organisations does not want to reveal the Application Server name and version to prevent finding this information easily by Attacker while fingerprinting the Application. The exact version number can tell an Attacker if the current Application Server is patched for or vulnerable to certain publicly known CVE associated to it.

The following property needs to be updated in the zeppelin-site.xml in order to set Server header.
The below property to mask Jetty server version is enabled by default and configured with value of " " (one whitespace char) in the zeppelin-site.xml

```xml
<property>
<name>zeppelin.server.jetty.name</name>
<value>Jetty(7.6.0.v20120127)</value>
<value> </value>
<description>Hardcoding Application Server name to Prevent Fingerprinting</description>
</property>
```

The value can be any "String".
The value can be any "String". Removing this property from configuration will cause Zeppelin to send correct Jetty server version.
4 changes: 2 additions & 2 deletions zeppelin-interpreter/src/main/java/org/apache/zeppelin/conf/ZeppelinConfiguration.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -944,14 +944,14 @@ public enum ConfVars {
ZEPPELIN_WEBSOCKET_MAX_TEXT_MESSAGE_SIZE("zeppelin.websocket.max.text.message.size", "10240000"),
ZEPPELIN_SERVER_DEFAULT_DIR_ALLOWED("zeppelin.server.default.dir.allowed", false),
ZEPPELIN_SERVER_XFRAME_OPTIONS("zeppelin.server.xframe.options", "SAMEORIGIN"),
ZEPPELIN_SERVER_JETTY_NAME("zeppelin.server.jetty.name", null),
ZEPPELIN_SERVER_JETTY_NAME("zeppelin.server.jetty.name", " "),
ZEPPELIN_SERVER_JETTY_THREAD_POOL_MAX("zeppelin.server.jetty.thread.pool.max", 400),
ZEPPELIN_SERVER_JETTY_THREAD_POOL_MIN("zeppelin.server.jetty.thread.pool.min", 8),
ZEPPELIN_SERVER_JETTY_THREAD_POOL_TIMEOUT("zeppelin.server.jetty.thread.pool.timeout", 30),
ZEPPELIN_SERVER_JETTY_REQUEST_HEADER_SIZE("zeppelin.server.jetty.request.header.size", 8192),
ZEPPELIN_SERVER_AUTHORIZATION_HEADER_CLEAR("zeppelin.server.authorization.header.clear", true),
ZEPPELIN_SERVER_STRICT_TRANSPORT("zeppelin.server.strict.transport", "max-age=631138519"),
ZEPPELIN_SERVER_X_XSS_PROTECTION("zeppelin.server.xxss.protection", "1"),
ZEPPELIN_SERVER_X_XSS_PROTECTION("zeppelin.server.xxss.protection", "1; mode=block"),
ZEPPELIN_SERVER_X_CONTENT_TYPE_OPTIONS("zeppelin.server.xcontent.type.options", "nosniff"),

ZEPPELIN_SERVER_KERBEROS_KEYTAB("zeppelin.server.kerberos.keytab", ""),
Expand Down