On this page

Coding Specifications
Whitelist-based Filter of IP Addresses
Preventing Sending the Absolute Paths to the Client
Same-origin Policy
Defense Against XSS
Preventing Sensitive Information Disclosure
Anti-Hijacking
Logging calls of the Web Service APIs
Cross-Site Request Forgery Prevention
Troubleshooting
HTML5 Security

Show all

Help Center/ MapReduce Service/ User Guide (Kuala Lumpur Region)/ MRS Cluster Component Operation Guide/ Using Flink/ Security Hardening/ Web Security

Web Security

Updated on 2022-08-12 GMT+08:00

View PDF

Coding Specifications

Note: The same coding mode is used on the web service client and server to prevent garbled characters and to enable input verification.

Security hardening: apply UTF-8 to response messages of web server.

Whitelist-based Filter of IP Addresses

Note: IP filter must be added to the web server to filter unauthorized requests from the source IP address and prevent unauthorized login.

Security: Add jobmanager.web.allow-access-address to enable the IP filter. By default, only Yarn users are supported.

NOTE:

After the client is installed, you need to add the IP address of the client node to the jobmanager.web.allow-access-address configuration item.

Preventing Sending the Absolute Paths to the Client

Note: If an absolute path is sent to a client, the directory structure of the server is exposed, increasing the risk that attackers know and attack the system.

Security hardening: If the Flink configuration file contains a parameter starting with a slash (/), the first-level directory is deleted.

Same-origin Policy

The same-source policy applies to MRS 3.x or later.

If two URL protocols have same hosts and ports, they are of the same origin. Protocols of different origins cannot access each other, unless the source of the visitor is specified on the host of the service to be visited.

Security hardening: The default value of the header of the response header Access-Control-Allow-Origin is the IP address of ResourceManager on Yarn clusters. If the IP address is not from Yarn, mutual access is not allowed.

Defense Against XSS

Defense Against XSS applies to MRS 3.x or later.

Disabling XSS filter incurs the following risks:

Leakage of sensitive information, for example, sessionid.
Tampering of pages.
Redirection to malicious websites.
DoS attacks from other websites to Flink web.

Security hardening: Add the X-XSS-Protection security header to enable XSS filter. The default value configuration is X-XSS-Protection: 1; mode=block. If XSS attack is detected, rendering of the page is stopped. For example, if XSS attacks are detected in Internet Explorer 8, all contents of the page is replaced by #.

Preventing Sensitive Information Disclosure

Sensitive information disclosure prevention is applicable to MRS 3.x or later.

Web pages containing sensitive data must not be cached, to avoid leakage of sensitive information or data crosstalk among users who visit the internet through the proxy server.

Security hardening: Add Cache-control, Pragma, Expires security header. The default value is Cache-Control: no-store, Pragma: no-cache, and Expires: 0.

The security hardening stops contents interacted between Flink and web server from being cached.

Anti-Hijacking

Anti-hijacking applies to MRS 3.x or later.

Since hotlinking and clickjacking use framing technologies, security hardening is required to prevent attacks.

Security hardening: Add X-Frame-Options security header to specify whether the browser will load the pages from iframe, frame or object. The default value is X-Frame-Options: DENY, indicating that no pages can be nested to iframe, frame or object.

Logging calls of the Web Service APIs

This function applies to MRS 3.x or later.

Calls of the Flink webmonitor restful APIs are logged.

The jobmanager.web.accesslog.enable can be added in the access log. The default value is true. Logs are stored in a separate webaccess.log file.

Cross-Site Request Forgery Prevention

Cross-site request forgery (CSRF) prevention applies to MRS 3.x or later.

In Browser/Server applications, CSRF must be prevented for operations involving server data modification, such as adding, modifying, and deleting. The CSRF forces end users to execute non-intended operations on the current web application.

Security hardening: Only two post APIs, one delete API, and get interfaces are reserve for modification requests. All other APIs are deleted.

Troubleshooting

This function applies to MRS 3.x or later.

When the application is abnormal, exception information is filtered, logged, and returned to the client.

Security hardening

A default error message page to filter information and log detailed error information.

Four configuration parameters are added to ensure that the error page is switched to a specified URL provided by FusionInsight, preventing exposure of unnecessary information.

**Table 1** Parameter description
Parameter	Description	Default Value	Mandatory
jobmanager.web.403-redirect-url	Web page access error 403. If 403 error occurs, the page switch to a specified page.	-	Yes
jobmanager.web.404-redirect-url	Web page access error 404. If 404 error occurs, the page switch to a specified page.	-	Yes
jobmanager.web.415-redirect-url	Web page access error 415. If 415 error occurs, the page switch to a specified page.	-	Yes
jobmanager.web.500-redirect-url	Web page access error 500. If 500 error occurs, the page switch to a specified page.	-	Yes

HTML5 Security

HTML5 security applies to MRS 3.x or later.

HTML5 is a next generation web development specification that provides new functions and extend the labels for developers. These new labels and functions increase the attack surface and pose attack risks (such as cross-domain resource sharing, client storage, WebWorker, WebRTC, and WebSocket).

Security hardening: Add the Access-Control-Allow-Origin parameter. For example, if you want to enable the cross-domain resource sharing, configure the Access-Control-Allow-Origin parameter of the HTTP response header.

NOTE:

Flink does not involve security risks of functions such as storage on the client, WebWorker, WebRTC, and WebSocket.

Parent topic: Security Hardening

Previous topic: ACL Control

Next topic: Security Statement

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot