Atlassian uses cookies to improve your browsing experience, perform analytics and research, and conduct advertising. Accept all cookies to indicate that you agree to our use of cookies on your device. Atlassian cookies and tracking notice, (opens new window)
Remove access to CDAP_Auth_Token in frontend and mark it httpOnly
Description
Currently we are accessing the CDAP_Auth_Token cookie in the client side JS script to set the Authorization header in some requests.
This is not a secure practice. Following is a list of changes to make this auth flow more secure.
It must be ensured that the CDAP instances are configured with the ssl.external.enabled flag set to true. (Not a responsibility of the cdap-ui package, this must be ensured at installation of cdap).
The CDAP_Auth_Token cookie must be set by the server, on user login, with the Secure , SameSite: strict and HttpOnly flags.
The CDAP_Auth_Token cookie must not be accessed / read by the client side JS. (client side JS can not read it, as it is now set with the HttpOnly flag by the server).
When a request is received by the ui server, the ui server must check for the CDAP_Auth_Token cookie and use its value to set the Authorization header before proxying the request to the backend servers.
Release Notes
None
Activity
Show:
Fixed
Pinned fields
Click on the next to a field label to start pinning.
Currently we are accessing the
CDAP_Auth_Tokencookie in the client side JS script to set the Authorization header in some requests.This is not a secure practice. Following is a list of changes to make this auth flow more secure.
It must be ensured that the CDAP instances are configured with the ssl.external.enabled flag set to true. (Not a responsibility of the cdap-ui package, this must be ensured at installation of cdap).
The
CDAP_Auth_Tokencookie must be set by the server, on user login, with theSecure,SameSite: strictandHttpOnlyflags.The
CDAP_Auth_Tokencookie must not be accessed / read by the client side JS. (client side JS can not read it, as it is now set with the HttpOnly flag by the server).When a request is received by the ui server, the ui server must check for the
CDAP_Auth_Tokencookie and use its value to set the Authorization header before proxying the request to the backend servers.