Mailing-List: contact common-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: common-issues@hadoop.apache.org
Date: Wed, 5 Mar 2014 02:04:43 +0000 (UTC)
From: "Haohui Mai (JIRA)" <jira@apache.org>
To: common-issues@hadoop.apache.org
Message-ID: <JIRA.12698524.1393886175299.2787.1393985083511@arcas>
In-Reply-To: <JIRA.12698524.1393886175299@arcas>
References: <JIRA.12698524.1393886175299@arcas>
Subject: [jira] [Commented] (HADOOP-10379) Protect authentication cookies
 with the HttpOnly and Secure flags
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/HADOOP-10379?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13920394#comment-13920394 ] 

Haohui Mai commented on HADOOP-10379:
-------------------------------------

I've committed the patch into trunk, branch-2, and branch-2.4. Thanks [~jingzhao] for the review.

> Protect authentication cookies with the HttpOnly and Secure flags
> -----------------------------------------------------------------
>
>                 Key: HADOOP-10379
>                 URL: https://issues.apache.org/jira/browse/HADOOP-10379
>             Project: Hadoop Common
>          Issue Type: Improvement
>            Reporter: Haohui Mai
>            Assignee: Haohui Mai
>             Fix For: 2.4.0
>
>         Attachments: HADOOP-10379.000.patch, HADOOP-10379.001.patch, HADOOP-10379.002.patch
>
>
> Browser vendors have adopted proposals to enhance the security of HTTP cookies. For example, the server can mark a cookie as {{Secure}} so that it will not be transfer via plain-text HTTP protocol, and the server can mark a cookie as {{HttpOnly}} to prohibit the JavaScript to access that cookie.
> This jira proposes to adopt these flags in Hadoop to protect the HTTP cookie used for authentication purposes.


--
This message was sent by Atlassian JIRA
(v6.2#6252)