From ad0811deb496ac215f6701ba8d071b76fc87ca44 Mon Sep 17 00:00:00 2001 From: Richard Zowalla Date: Wed, 19 Aug 2026 08:35:10 +0200 Subject: [PATCH] Set the CORS filter credentials parameter explicitly instead of a header name that the filter ignores --- .../java/org/apache/storm/daemon/ui/UIHelpers.java | 2 +- .../org/apache/storm/daemon/ui/UIHelpersTest.java | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java index 77f43a3989..aaa323fd85 100644 --- a/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java +++ b/storm-webapp/src/main/java/org/apache/storm/daemon/ui/UIHelpers.java @@ -324,7 +324,7 @@ public static FilterHolder corsFilterHandle() { CrossOriginFilter.ALLOWED_HEADERS_PARAM, "X-Requested-With, X-Requested-By, Access-Control-Allow-Origin," + " Content-Type, Content-Length, Accept, Origin"); - filterHolder.setInitParameter(CrossOriginFilter.ACCESS_CONTROL_ALLOW_ORIGIN_HEADER, "*"); + filterHolder.setInitParameter(CrossOriginFilter.ALLOW_CREDENTIALS_PARAM, "false"); return filterHolder; } diff --git a/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java b/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java index 1ef066b8ef..09a31f2440 100644 --- a/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java +++ b/storm-webapp/src/test/java/org/apache/storm/daemon/ui/UIHelpersTest.java @@ -30,6 +30,8 @@ import org.apache.storm.generated.TopologyStats; import org.apache.storm.utils.Time; import net.minidev.json.JSONValue; +import org.eclipse.jetty.ee10.servlet.FilterHolder; +import org.eclipse.jetty.ee10.servlets.CrossOriginFilter; import org.eclipse.jetty.server.Server; import org.eclipse.jetty.server.ServerConnector; import org.eclipse.jetty.server.SslConnectionFactory; @@ -724,4 +726,15 @@ public void testConfigSslKeepsJettyDefaultTlsExclusions(@TempDir Path tempDir) t assertEquals(expectedProtocols, new LinkedHashSet<>(Arrays.asList(factory.getExcludeProtocols()))); assertEquals(expectedCiphers, new LinkedHashSet<>(Arrays.asList(factory.getExcludeCipherSuites()))); } + + @Test + public void testCorsFilterHandleSetsExplicitInitParameters() { + FilterHolder filterHolder = UIHelpers.corsFilterHandle(); + assertEquals("*", filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_ORIGINS_PARAM)); + assertEquals("GET, POST, PUT", filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_METHODS_PARAM)); + assertEquals("X-Requested-With, X-Requested-By, Access-Control-Allow-Origin," + + " Content-Type, Content-Length, Accept, Origin", + filterHolder.getInitParameter(CrossOriginFilter.ALLOWED_HEADERS_PARAM)); + assertEquals("false", filterHolder.getInitParameter(CrossOriginFilter.ALLOW_CREDENTIALS_PARAM)); + } }