Elgato_dark/zeppelin
1
0
Fork 0
mirror of https://github.com/apache/zeppelin synced 2026-05-24 09:38:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

ZEPPELIN-2873 - Add documentation on Zeppelin Shiro's abliity to configure secure cookie

Browse source 
Added secure cookie option description in Shiro Authentiction doc.
This commit is contained in:
Vipin Rathor 2017-08-21 18:47:32 -07:00
parent f6b58ee5a0
commit fec8d7edc2
1 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
docs/setup/security/shiro_authentication.md
View file

@ -210,6 +210,21 @@ securityManager.realms = $zeppelinHubRealm
> Note: ZeppelinHub is not releated to Apache Zeppelin project.
## Secure Cookie for Zeppelin Sessions (optional)
Zeppelin can be configured to set `HttpOnly` flag in the session cookie. With this configuration, Zeppelin cookies can
not be accessed via client side scripts thus preventing Cross-site scripting (XSS) attacks.
To enable secure cookie support via Shiro, add the following lines in `conf/shiro.ini` under `[main]` section, after
defining a `sessionManager`.
```
cookie = org.apache.shiro.web.servlet.SimpleCookie
cookie.name = JSESSIONID
cookie.secure = true
cookie.httpOnly = true
sessionManager.sessionIdCookie = $cookie
```
## Secure your Zeppelin information (optional)
By default, anyone who defined in `[users]` can share **Interpreter Setting**, **Credential** and **Configuration** information in Apache Zeppelin.
Sometimes you might want to hide these information for your use case.