Repository navigation
Conversation
ErmiasG
marked this pull request as ready for review
November 10, 2026 15:23
ErmiasG
force-pushed
the
HWORKS-3754
branch
2 times, most recently
from
November 11, 2026 10:31
4ba210e to
bc2874e
Compare
…tigation https://hopsworks.atlassian.net/browse/HWORKS-3754 Hopsworks sets restrictive security response headers itself, in its application server, on the UI, its REST endpoints, its error pages and the services it proxies, so they apply whatever sits in front of the cluster. Every cookie it issues or passes on carries Secure and SameSite=Lax, and its own cookies are HttpOnly. The UI runs under an enforced Content-Security-Policy, which Helm values tune without a restart. The backend adds the headers filter, the cookie handling and the image changes; the chart adds the policy values, ConfigMap and mounts; the frontend becomes CSP-compatible; the loadtest checks the headers on a cluster; the docs describe the headers, the values and the upgrade. The docs add an admin page on the security headers: the headers per kind of response, the cookie attributes, the Helm values, the report-only switch and how to use it, extra sources for model deployments on another host and for sites that frame the UI, and HSTS with its prerequisite and undo. A 5.2.x to 5.3.x upgrade note points to it. Reviewed-by: OpenAI Codex (codex-plugin-cc 1.0.4) <codex@openai.com> Signed-off-by: Ermias Gebremeskel <ermias@logicalclocks.com> Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://hopsworks.atlassian.net/browse/HWORKS-3754
Summary
setup_installation/admin/security_headers.md: the headers Hopsworks sets on the UI, its REST endpoints, its error pages and the services it proxies, the cookie attributes, and thehopsworks.payara.securityHeadersHelm values. It covers the report-only switch and how to use it, extra sources for model deployments on another host or port and for sites that frame the UI, and HSTS with its HTTPS prerequisite and how to undo it.Related
Test plan
hopsworks-docs markdownlinthopsworks-docs check: no warnings from these pages; the strict build stops on six cross-references inuser_guides/mlops/serving/rest-api.mdto API symbols the local hopsworks-api copy lacks, unrelated to this PR🤖 Generated with Claude Code