vpruthi/doc-exports
1
0
Fork 0
forked from docs/doc-exports
Code Pull Requests Activity
doc-exports/docs/mrs/component-operation-guide/mrs_01_1585.html
Yang, Tong 6182f91ba8 MRS component operation guide_normal 2.0.38.SP20 version 
Reviewed-by: Hasko, Vladimir <vladimir.hasko@t-systems.com>
Co-authored-by: Yang, Tong <yangtong2@huawei.com>
Co-committed-by: Yang, Tong <yangtong2@huawei.com>
2022-12-09 14:55:21 +00:00

104 lines
14 KiB
HTML
Raw Blame History

<a name="mrs_01_1585"></a><a name="mrs_01_1585"></a>
<h1 class="topictitle1">Web Security</h1>
<div id="body1596441032921"><div class="section" id="mrs_01_1585__section1627419181102"><h4 class="sectiontitle">Coding Specifications</h4><p id="mrs_01_1585__p1364094615101">Note: The same coding mode is used on the web service client and server to prevent garbled characters and to enable input verification.</p>
<p id="mrs_01_1585__p2064019467101">Security hardening: apply UTF-8 to response messages of web server.</p>
</div>
<div class="section" id="mrs_01_1585__section163105213118"><h4 class="sectiontitle">Whitelist-based Filter of IP Addresses</h4><p id="mrs_01_1585__p1552264015111">Note: IP filter must be added to the web server to filter unauthorized requests from the source IP address and prevent unauthorized login.</p>
<p id="mrs_01_1585__p155235403114">Security: Add <strong id="mrs_01_1585__b26092780210435">jobmanager.web.allow-access-address</strong> to enable the IP filter. By default, only Yarn users are supported.</p>
<div class="note" id="mrs_01_1585__note270317102316"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="mrs_01_1585__p19369191644619">After the client is installed, you need to add the IP address of the client node to the <strong id="mrs_01_1585__b1962202453218">jobmanager.web.allow-access-address</strong> configuration item.</p>
</div></div>
</div>
<div class="section" id="mrs_01_1585__section1417310220123"><h4 class="sectiontitle">Preventing Sending the Absolute Paths to the Client</h4><p id="mrs_01_1585__p642691419139">Note: If an absolute path is sent to a client, the directory structure of the server is exposed, increasing the risk that attackers know and attack the system.</p>
<p id="mrs_01_1585__p1142620147132">Security hardening: If the Flink configuration file contains a parameter starting with a slash (/), the first-level directory is deleted.</p>
</div>
<div class="section" id="mrs_01_1585__sb79f6827ac144ae9b077185b04d2aa71"><h4 class="sectiontitle">Same-origin Policy</h4><p id="mrs_01_1585__p9857944122112">The same-source policy applies to MRS 3.x or later.</p>
<p id="mrs_01_1585__a19887e17728b46a8b12727d318802a0b">If two URL protocols have same hosts and ports, they are of the same origin. Protocols of different origins cannot access each other, unless the source of the visitor is specified on the host of the service to be visited.</p>
<p id="mrs_01_1585__a70e085b31ce744e2879a7fd0796d2272">Security hardening: The default value of the header of the response header <span class="parmname" id="mrs_01_1585__p93a360734bf246ceb19c5300c256fc3b"><b>Access-Control-Allow-Origin</b></span> is the IP address of ResourceManager on Yarn clusters. If the IP address is not from Yarn, mutual access is not allowed.</p>
</div>
<div class="section" id="mrs_01_1585__s42852a9d186e4e7d8e27d2a4be5cda5c"><h4 class="sectiontitle">Preventing Sensitive Information Disclosure</h4><p id="mrs_01_1585__p1172793862717">Sensitive information disclosure prevention is applicable to MRS 3.x or later.</p>
<p id="mrs_01_1585__a85b241a6228446258c4c1f490f1378f0">Web pages containing sensitive data must not be cached, to avoid leakage of sensitive information or data crosstalk among users who visit the internet through the proxy server.</p>
<p id="mrs_01_1585__ae4095e96610444488c4514a9ddcde3d2">Security hardening: Add <span class="parmname" id="mrs_01_1585__parmname213293781910435"><b>Cache-control</b></span>, <span class="parmname" id="mrs_01_1585__parmname136331994110435"><b>Pragma</b></span>, <span class="parmname" id="mrs_01_1585__parmname44372899310435"><b>Expires</b></span> security header. The default value is <span class="parmvalue" id="mrs_01_1585__parmvalue89536330610435"><b>Cache-Control: no-store</b></span>, <span class="parmvalue" id="mrs_01_1585__parmvalue151740283010435"><b>Pragma: no-cache</b></span>, and <span class="parmvalue" id="mrs_01_1585__parmvalue52131524910435"><b>Expires: 0</b></span>.</p>
<p id="mrs_01_1585__a86b93f463ef94685b09c44c75567c009">The security hardening stops contents interacted between Flink and web server from being cached.</p>
</div>
<div class="section" id="mrs_01_1585__sff8eb0099b2d424f9a3c979aa685b1aa"><h4 class="sectiontitle">Anti-Hijacking</h4><p id="mrs_01_1585__p77218253287">Anti-hijacking applies to MRS 3.x or later.</p>
<p id="mrs_01_1585__a1a02844271ec403c8284d699aab19c23">Since hotlinking and clickjacking use framing technologies, security hardening is required to prevent attacks.</p>
<p id="mrs_01_1585__a699f930106c245ef9cd8e9f4e732f16d">Security hardening: Add <span class="parmname" id="mrs_01_1585__parmname57736826510435"><b>X-Frame-Options</b></span> security header to specify whether the browser will load the pages from <span class="wintitle" id="mrs_01_1585__wintitle63794605410435"><b>iframe</b></span>, <span class="wintitle" id="mrs_01_1585__wintitle197481164610435"><b>frame</b></span> or <span class="wintitle" id="mrs_01_1585__wintitle172369172810435"><b>object</b></span>. The default value is <span class="parmname" id="mrs_01_1585__parmname18868875810435"><b>X-Frame-Options: DENY</b></span>, indicating that no pages can be nested to <span class="wintitle" id="mrs_01_1585__wintitle53549892710435"><b>iframe</b></span>, <span class="wintitle" id="mrs_01_1585__wintitle113020989510435"><b>frame</b></span> or <span class="wintitle" id="mrs_01_1585__wintitle132510187010435"><b>object</b></span>.</p>
</div>
<div class="section" id="mrs_01_1585__s7e946ce5c3294b0dacaa5787b8302214"><h4 class="sectiontitle">Logging calls of the Web Service APIs</h4><p id="mrs_01_1585__p44871359172818">This function applies to MRS 3.x or later.</p>
<p id="mrs_01_1585__a392b81a43f32413fbe706cf288edc987">Calls of the <span class="parmname" id="mrs_01_1585__p233b4958dfe54206a978a48dc30fbfe8"><b>Flink webmonitor restful</b></span> APIs are logged.</p>
<p id="mrs_01_1585__a83eb099900a14eaeb4ddceb2abb761c7">The <span class="parmname" id="mrs_01_1585__p914a092e26d148599a5431a3f71d9068"><b>jobmanager.web.accesslog.enable</b></span> can be added in the <span class="filepath" id="mrs_01_1585__fb6c5cfe2616d4729a817f9f01d8cf0d8"><b>access log</b></span>. The default value is <span class="parmvalue" id="mrs_01_1585__pc414865cd968402bb26db2ff8db9f3fb"><b>true</b></span>. Logs are stored in a separate <span class="filepath" id="mrs_01_1585__ff6cea9819d534cfa9460b2c9cf7d59e6"><b>webaccess.log</b></span> file.</p>
</div>
<div class="section" id="mrs_01_1585__s9c6e4194ccd440b39317613532b12244"><h4 class="sectiontitle">Cross-Site Request Forgery Prevention</h4><p id="mrs_01_1585__p16904973118">Cross-site request forgery (CSRF) prevention applies to MRS 3.x or later.</p>
<p id="mrs_01_1585__a5d1929d4597e42ceb4f8bcfe30d9b3e2">In <strong id="mrs_01_1585__b125169997810435">Browser/Server</strong> applications, CSRF must be prevented for operations involving server data modification, such as adding, modifying, and deleting. The CSRF forces end users to execute non-intended operations on the current web application.</p>
<p id="mrs_01_1585__ac773e543328045898efdb03117e3a657">Security hardening: Only two post APIs, one delete API, and get interfaces are reserve for modification requests. All other APIs are deleted.</p>
</div>
<div class="section" id="mrs_01_1585__s66ee262aa1f642159d8663af3045bdda"><h4 class="sectiontitle">Troubleshooting</h4><p id="mrs_01_1585__p754865593117">This function applies to MRS 3.x or later.</p>
<p id="mrs_01_1585__a8dd26f79163f492895a3b07b658544d2">When the application is abnormal, exception information is filtered, logged, and returned to the client.</p>
<p id="mrs_01_1585__abeac679fc5bf45e5a8c0ebceb5dcc7bb">Security hardening</p>
<ul id="mrs_01_1585__ue557464eb32d470f82f85dab73ca4bdc"><li id="mrs_01_1585__l1738bc80925c488ab437270922f9023a">A default error message page to filter information and log detailed error information.</li><li id="mrs_01_1585__l56b555db98c747cb9c49aa155ff7fd1c">Four configuration parameters are added to ensure that the error page is switched to a specified URL provided by FusionInsight, preventing exposure of unnecessary information.
<div class="tablenoborder"><table cellpadding="4" cellspacing="0" summary="" id="mrs_01_1585__t50f10913e90c4be086f05134a5e3d8af" frame="border" border="1" rules="all"><caption><b>Table 1 </b>Parameter description</caption><thead align="left"><tr id="mrs_01_1585__r3c82398408344bb5b2c04e89e253cb4f"><th align="left" class="cellrowborder" valign="top" width="25%" id="mcps1.3.9.5.2.1.2.5.1.1"><p id="mrs_01_1585__a8c47233333484ea193db39b34a9f93c3"><strong id="mrs_01_1585__b3321194917413">Parameter</strong></p>
</th>
<th align="left" class="cellrowborder" valign="top" width="25%" id="mcps1.3.9.5.2.1.2.5.1.2"><p id="mrs_01_1585__a4de425c85ebd462b9a61e9bba5bded6b"><strong id="mrs_01_1585__ab7c738c432c349fda0fe79c586bbf376">Description</strong></p>
</th>
<th align="left" class="cellrowborder" valign="top" width="25%" id="mcps1.3.9.5.2.1.2.5.1.3"><p id="mrs_01_1585__a4aab0f0d9b87469daec72805b8a36528"><strong id="mrs_01_1585__a7521053abe314121bfadbe5011c0cd29">Default Value</strong></p>
</th>
<th align="left" class="cellrowborder" valign="top" width="25%" id="mcps1.3.9.5.2.1.2.5.1.4"><p id="mrs_01_1585__ab483eac023a345f68fc5a4bb72db2078">Mandatory</p>
</th>
</tr>
</thead>
<tbody><tr id="mrs_01_1585__r125378f3d22548758262afa3cecf6a84"><td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.1 "><p id="mrs_01_1585__aabbd050b59aa4b03849bf27d26fe1941">jobmanager.web.403-redirect-url</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.2 "><p id="mrs_01_1585__a66a91a2088ee44f99556bbcb6dd724c3">Web page access error 403. If 403 error occurs, the page switch to a specified page.</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.3 "><p id="mrs_01_1585__aa3d00a0c087e46cda54520742e39b802">-</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.4 "><p id="mrs_01_1585__a394a30d3ee7a409c93262658b4c6242f">Yes</p>
</td>
</tr>
<tr id="mrs_01_1585__r80705d2b2c064ed7b5e40cb216d53730"><td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.1 "><p id="mrs_01_1585__a33304d61af4d428caa3660b86241ed30">jobmanager.web.404-redirect-url</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.2 "><p id="mrs_01_1585__a98cb338f16114248a372a5dd3cc6c291">Web page access error 404. If 404 error occurs, the page switch to a specified page.</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.3 "><p id="mrs_01_1585__ac0b2096d45654d08acd7c33ee7503f4e">-</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.4 "><p id="mrs_01_1585__ae55c95ac6af04aafb5aed43508e80d1a">Yes</p>
</td>
</tr>
<tr id="mrs_01_1585__r78fa120714b94ea0b0d5b6ac0326190a"><td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.1 "><p id="mrs_01_1585__a4eea5bfa9e754d95a74f342e1eb376eb">jobmanager.web.415-redirect-url</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.2 "><p id="mrs_01_1585__a8c795a79af6f45d1ac3f5dda1a317752">Web page access error 415. If 415 error occurs, the page switch to a specified page.</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.3 "><p id="mrs_01_1585__a803aa9ae57b1406aae969f8d25c745b5">-</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.4 "><p id="mrs_01_1585__a083c0e58d3314c3392daee2b765c831f">Yes</p>
</td>
</tr>
<tr id="mrs_01_1585__r874660eacb604eb794101b050fcb454d"><td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.1 "><p id="mrs_01_1585__a57f8082a520c4e7e972f22ab12b54bf0">jobmanager.web.500-redirect-url</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.2 "><p id="mrs_01_1585__a82a9dcf7846a476abc238f2a2d2ae9a3">Web page access error 500. If 500 error occurs, the page switch to a specified page.</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.3 "><p id="mrs_01_1585__a76cd3e9021bf4f0c9799323e653c5740">-</p>
</td>
<td class="cellrowborder" valign="top" width="25%" headers="mcps1.3.9.5.2.1.2.5.1.4 "><p id="mrs_01_1585__a8d81033bf19b4b9a848a1d8550878d54">Yes</p>
</td>
</tr>
</tbody>
</table>
</div>
</li></ul>
</div>
<div class="section" id="mrs_01_1585__sf1bdafc4eed14fe399dc3ffbdce19a48"><h4 class="sectiontitle">HTML5 Security</h4><p id="mrs_01_1585__p1244416228326">HTML5 security applies to MRS 3.x or later.</p>
<p id="mrs_01_1585__aa12838891ff0436799228133b6d52513">HTML5 is a next generation web development specification that provides new functions and extend the labels for developers. These new labels and functions increase the attack surface and pose attack risks (such as cross-domain resource sharing, client storage, WebWorker, WebRTC, and WebSocket).</p>
<div class="p" id="mrs_01_1585__a5025ac3d967d42daa864cd7546e99cb6">Security hardening: Add the <span class="parmname" id="mrs_01_1585__parmname133280939110435"><b>Access-Control-Allow-Origin</b></span> parameter. For example, if you want to enable the cross-domain resource sharing, configure the <span class="parmname" id="mrs_01_1585__parmname161053756310435"><b>Access-Control-Allow-Origin</b></span> parameter of the HTTP response header.<div class="note" id="mrs_01_1585__n708edc8ad0054037b4c6e545a9252392"><img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span><div class="notebody"><p id="mrs_01_1585__a32977854bdd74f14854efe9ba0d265bc">Flink does not involve security risks of functions such as storage on the client, WebWorker, WebRTC, and WebSocket.</p>
</div></div>
</div>
</div>
</div>
<div>
<div class="familylinks">
<div class="parentlink"><strong>Parent topic:</strong> <a href="mrs_01_0594.html">Security Hardening</a></div>
</div>
</div>
View Git Blame Copy Permalink