001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hbase.http;
019
020import static org.apache.hadoop.hbase.http.HttpServerFunctionalTest.createTestServer;
021import static org.apache.hadoop.hbase.http.HttpServerFunctionalTest.getServerURL;
022import static org.hamcrest.CoreMatchers.equalTo;
023import static org.hamcrest.CoreMatchers.is;
024import static org.hamcrest.CoreMatchers.not;
025import static org.hamcrest.MatcherAssert.assertThat;
026
027import java.io.IOException;
028import java.net.HttpURLConnection;
029import java.net.URL;
030import org.apache.hadoop.conf.Configuration;
031import org.apache.hadoop.hbase.testclassification.MediumTests;
032import org.hamcrest.core.Is;
033import org.hamcrest.core.IsEqual;
034import org.junit.jupiter.api.AfterEach;
035import org.junit.jupiter.api.Tag;
036import org.junit.jupiter.api.Test;
037
038@Tag(MediumTests.TAG)
039public class TestSecurityHeadersFilter {
040  private static URL baseUrl;
041  private HttpServer http;
042
043  @AfterEach
044  public void tearDown() throws Exception {
045    http.stop();
046  }
047
048  @Test
049  public void testDefaultValues() throws Exception {
050    http = createTestServer();
051    http.start();
052    baseUrl = getServerURL(http);
053
054    URL url = new URL(baseUrl, "/");
055    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
056    assertThat(conn.getResponseCode(), equalTo(HttpURLConnection.HTTP_OK));
057
058    assertThat("Header 'X-Content-Type-Options' is missing",
059      conn.getHeaderField("X-Content-Type-Options"), is(not((String) null)));
060    assertThat(conn.getHeaderField("X-Content-Type-Options"), equalTo("nosniff"));
061    assertThat("Header 'X-XSS-Protection' is missing", conn.getHeaderField("X-XSS-Protection"),
062      is(not((String) null)));
063    assertThat("Header 'X-XSS-Protection' has invalid value",
064      conn.getHeaderField("X-XSS-Protection"), equalTo("1; mode=block"));
065
066    assertThat(
067      "Header 'Strict-Transport-Security' should be missing from response," + "but it's present",
068      conn.getHeaderField("Strict-Transport-Security"), is((String) null));
069    assertThat(
070      "Header 'Content-Security-Policy' should be missing from response," + "but it's present",
071      conn.getHeaderField("Content-Security-Policy"), is((String) null));
072  }
073
074  @Test
075  public void testHstsAndCspSettings() throws IOException {
076    Configuration conf = new Configuration();
077    conf.set("hbase.http.filter.hsts.value", "max-age=63072000;includeSubDomains;preload");
078    conf.set("hbase.http.filter.csp.value",
079      "default-src https: data: 'unsafe-inline' 'unsafe-eval'");
080    http = createTestServer(conf);
081    http.start();
082    baseUrl = getServerURL(http);
083
084    URL url = new URL(baseUrl, "/");
085    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
086    assertThat(conn.getResponseCode(), equalTo(HttpURLConnection.HTTP_OK));
087
088    assertThat("Header 'Strict-Transport-Security' is missing from Rest response",
089      conn.getHeaderField("Strict-Transport-Security"), Is.is(not((String) null)));
090    assertThat("Header 'Strict-Transport-Security' has invalid value",
091      conn.getHeaderField("Strict-Transport-Security"),
092      IsEqual.equalTo("max-age=63072000;includeSubDomains;preload"));
093
094    assertThat("Header 'Content-Security-Policy' is missing from Rest response",
095      conn.getHeaderField("Content-Security-Policy"), Is.is(not((String) null)));
096    assertThat("Header 'Content-Security-Policy' has invalid value",
097      conn.getHeaderField("Content-Security-Policy"),
098      IsEqual.equalTo("default-src https: data: 'unsafe-inline' 'unsafe-eval'"));
099  }
100}