[ZEPPELIN-6366] Separate WebSocket max message size into a dedicated REST API #5099

seung-00 · 2025-10-08T09:52:17Z

What is this PR for?

Currently, configuration data is fetched through both REST API and WebSocket channels. However, the WebSocket path does not perform permission checks, and the only required data from it is the WebSocket max message size.

I extracted the websocket max message size field into a dedicated REST API, to improve security and simplify configuration handling.

What type of PR is it?

Improvement

Todos

[ZEPPELIN-6312] Remove configuration WS usage in frontend #5060

What is the Jira issue?

Open an issue on Jira https://issues.apache.org/jira/browse/ZEPPELIN/6366

How should this be tested?

Check the configuration page (/configuration)
Check the notebook page (/notebook/{notebook_id})

Screenshots (if appropriate)

Questions:

Does the license files need to update? N
Is there breaking changes for older versions? N
Does this needs documentation? N

zeppelin-web-angular/src/app/services/configuration.service.ts

Reamer · 2025-10-08T19:43:05Z

I don't know if we should also adapt zeppelin-web? What do you think?

tbonelee · 2025-10-09T08:23:24Z

@Reamer Looks reasonable for zeppelin-web too. Are there specific concerns you’re considering, such as maintenance or behavior differences?

tbonelee · 2025-10-09T08:41:24Z

@seung-00
(If we also apply this to zeppelin-web.)
There is a failing test in zeppelin-integration(test-selenium-with-spark-module-for-spark-3-5 CI job).
After a quick note: in zeppelin-web's NoteImportCtrl, wsMaxMessageSize is called even when the user is not logged in.
The server then returns a 302 redirect to /api/login (shiro.loginUrl). When the login API responds with 405, the HTTP interceptor emits session_logout (

zeppelin/zeppelin-web/src/app/app.js

Line 170 in f1f6713

$rootScope.$broadcast('session_logout', data);

). The login controller listens for session_logout and programmatically clicks the login button (.nav-login-btn).
As a result, the login modal pops up immediately when the window opens, which is different from before, and the integration test fails.

It looks like we should change this to issue the API request only when the user is authenticated, or defer it until the moment it is actually needed.

Reamer · 2025-10-09T11:44:13Z

@Reamer Looks reasonable for zeppelin-web too. Are there specific concerns you’re considering, such as maintenance or behavior differences?

Yes both. All frontends should use the same interfaces. This makes it easier to remove things later on.

…REST API

seung-00 · 2025-10-12T10:46:39Z

@Reamer
In this case I applied it to both, as you mentioned, to make it easier to remove unreferenced things later on.
But I don’t think we need to do that for every task. Covering both sides would be a bit tricky, since the front-end codebases are quite different.

@tbonelee
I fixed the issue you mentioned.
If the CI failed due to the login modal, I think the CI job might need to be adjusted instead, because the wsMaxMessageSize API doesn’t require authentication.
However, I found that wsMaxMessageSize was being called and cached initially (same as before), but the field only needed in specific cases (e.g., exporting/importing note). So I modified it to be called only when required, now the CI error no longer occurs.

BTW, if the user isn’t logged in initially, showing the login modal seems more natural. 🤔

zeppelin-integration/src/test/java/org/apache/zeppelin/integration/ZeppelinIT.java

tbonelee

Everything seems right but the unused imports should be removed.

zeppelin-web-angular/src/app/app.module.ts

Co-authored-by: ChanHo Lee <[email protected]>

tbonelee

LGTM. I also agree with showing a login modal when authentication is required. Maybe we could address that in another issue.

Reamer

But I don’t think we need to do that for every task. Covering both sides would be a bit tricky, since the front-end codebases are quite different.

Sooner or later, we should send the old front end into well-deserved retirement. In my opinion, sooner rather than later.

Reamer · 2025-10-15T07:05:07Z

zeppelin-server/src/main/java/org/apache/zeppelin/rest/ConfigurationsRestApi.java

 import org.apache.zeppelin.service.AuthenticationService;

 /** Configurations Rest API Endpoint. */
-@Path("/configurations")


You have changed the path of the API class here. Probably so that the call is /api/wsMaxMessageSize. However, I also think /api/configurations/wsMaxMessageSize is very good and would prefer this API endpoint.

@Reamer
I also think the path you mentioned looks good. However, since the authentication referenced in shiro.ini appears to be set up based on the /configuration path, I excluded /configurations from the path. The wsMaxMessageSize API is intended to be a non-authenticated API.

Please feel free to let me know if you have any other suggestions. 🤔

@Reamer
Would you mind taking a look at this?
The issue this PR addresses, configuration data being accessible via WebSocket without a permission check because of the wsMaxMessageSize field, seems to be a clear problem that needs to be fixed.

Hi @seung-00 ,
Thank you for bringing this issue to my attention again.

As I see it, we have the following options.

We include the path /api/configurations/wsMaxMessageSize in shiro.ini and give unauthenticated users the right to call this endpoint.
This would be a breaking change.

We add a new path, but it would also have to contain something related to configuration in the path, e.g., /api/configuration/wsMaxMessageSize (without s). The entire API endpoint would then also have to be mapped to a new class.
The shiro.ini would also have to be adjusted here, and that would also be a breaking change.

What bothers me about 1) is that potentially new frontend configuration options would also have to be added to the shiro.ini.
What bothers me about 2) is that it's quite confusing, but you probably only need to adjust the shiro.ini once.

What do you think about creating a general endpoint for frontend configurations? With this pull request, it's wsMaxMessageSize, tomorrow it might be something else. Then you could build the whole thing in the ConfigurationsRestApi and use frontend-config or something else as the endpoint path. You would only have to adjust shiro.ini once and extend the map that the endpoint returns.

Either way, this change would be a breaking change, since the shiro.ini, for example, is very variable.
See: https://github.com/apache/zeppelin/blob/master/conf/shiro.ini.template#L129-L130

seung-00 force-pushed the feature/ZEPPELIN-6366 branch from 8a0cd93 to 001b3d6 Compare October 8, 2025 09:53

tbonelee requested changes Oct 8, 2025

View reviewed changes

zeppelin-web-angular/src/app/services/configuration.service.ts Outdated Show resolved Hide resolved

seung-00 force-pushed the feature/ZEPPELIN-6366 branch from 001b3d6 to ed1cae5 Compare October 8, 2025 13:05

seung-00 added 3 commits October 11, 2025 16:31

[ZEPPELIN-6366] Separate WebSocket max message size into a dedicated …

bb1d389

…REST API

[ZEPPELIN-6366] Separate WebSocket max message size into a dedicated …

5b11d3c

…REST API

[ZEPPELIN-6366] Separate WebSocket max message size into a dedicated …

3e5933e

…REST API

seung-00 force-pushed the feature/ZEPPELIN-6366 branch from de8726d to 3e5933e Compare October 11, 2025 07:31

seung-00 added 2 commits October 11, 2025 18:23

[ZEPPELIN-6366] Separate WebSocket max message size into a dedicated …

f4969a2

…REST API

[ZEPPELIN-6366] Separate WebSocket max message size into a dedicated …

6025ab1

…REST API

seung-00 requested a review from tbonelee October 12, 2025 10:47

seung-00 commented Oct 12, 2025

View reviewed changes

zeppelin-integration/src/test/java/org/apache/zeppelin/integration/ZeppelinIT.java Show resolved Hide resolved

tbonelee requested changes Oct 14, 2025

View reviewed changes

zeppelin-web-angular/src/app/app.module.ts Outdated Show resolved Hide resolved

zeppelin-web-angular/src/app/app.module.ts Outdated Show resolved Hide resolved

seung-00 and others added 2 commits October 15, 2025 13:16

Update zeppelin-web-angular/src/app/app.module.ts

36dade4

Co-authored-by: ChanHo Lee <[email protected]>

Update zeppelin-web-angular/src/app/app.module.ts

f1de090

Co-authored-by: ChanHo Lee <[email protected]>

tbonelee approved these changes Oct 15, 2025

View reviewed changes

Reamer requested changes Oct 15, 2025

View reviewed changes

seung-00 requested a review from Reamer October 15, 2025 13:14

[ZEPPELIN-6366] Separate WebSocket max message size into a dedicated REST API #5099

Are you sure you want to change the base?

[ZEPPELIN-6366] Separate WebSocket max message size into a dedicated REST API #5099

Uh oh!

Conversation

seung-00 commented Oct 8, 2025

What is this PR for?

What type of PR is it?

Todos

What is the Jira issue?

How should this be tested?

Screenshots (if appropriate)

Questions:

Uh oh!

Uh oh!

Reamer commented Oct 8, 2025

Uh oh!

tbonelee commented Oct 9, 2025

Uh oh!

tbonelee commented Oct 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reamer commented Oct 9, 2025

Uh oh!

seung-00 commented Oct 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

tbonelee left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

tbonelee left a comment

Choose a reason for hiding this comment

Uh oh!

Reamer left a comment

Choose a reason for hiding this comment

Uh oh!

Reamer Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

seung-00 Oct 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

seung-00 Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reamer Nov 3, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

tbonelee commented Oct 9, 2025 •

edited

Loading

seung-00 commented Oct 12, 2025 •

edited

Loading

Reamer Oct 15, 2025 •

edited

Loading

seung-00 Oct 15, 2025 •

edited

Loading

seung-00 Oct 31, 2025 •

edited

Loading