001/**
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hbase.http;
019
020import static org.apache.hadoop.hbase.http.HttpServerFunctionalTest.createTestServer;
021import static org.apache.hadoop.hbase.http.HttpServerFunctionalTest.getServerURL;
022import static org.hamcrest.CoreMatchers.equalTo;
023import static org.hamcrest.CoreMatchers.is;
024import static org.hamcrest.CoreMatchers.not;
025import static org.junit.Assert.assertThat;
026import java.io.IOException;
027import java.net.HttpURLConnection;
028import java.net.URL;
029import org.apache.hadoop.conf.Configuration;
030import org.apache.hadoop.hbase.HBaseClassTestRule;
031import org.apache.hadoop.hbase.testclassification.MediumTests;
032import org.hamcrest.core.Is;
033import org.hamcrest.core.IsEqual;
034import org.junit.After;
035import org.junit.ClassRule;
036import org.junit.Test;
037import org.junit.experimental.categories.Category;
038
039@Category({HttpServerFunctionalTest.class, MediumTests.class})
040public class TestSecurityHeadersFilter {
041  private static URL baseUrl;
042  private HttpServer http;
043
044  @ClassRule
045  public static final HBaseClassTestRule CLASS_RULE =
046      HBaseClassTestRule.forClass(TestSecurityHeadersFilter.class);
047
048  @After
049  public void tearDown() throws Exception {
050    http.stop();
051  }
052
053  @Test
054  public void testDefaultValues() throws Exception {
055    http = createTestServer();
056    http.start();
057    baseUrl = getServerURL(http);
058
059    URL url = new URL(baseUrl, "/");
060    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
061    assertThat(conn.getResponseCode(), equalTo(HttpURLConnection.HTTP_OK));
062
063    assertThat("Header 'X-Content-Type-Options' is missing",
064        conn.getHeaderField("X-Content-Type-Options"), is(not((String)null)));
065    assertThat(conn.getHeaderField("X-Content-Type-Options"), equalTo("nosniff"));
066    assertThat("Header 'X-XSS-Protection' is missing",
067        conn.getHeaderField("X-XSS-Protection"), is(not((String)null)));
068    assertThat("Header 'X-XSS-Protection' has invalid value",
069        conn.getHeaderField("X-XSS-Protection"), equalTo("1; mode=block"));
070
071    assertThat("Header 'Strict-Transport-Security' should be missing from response," +
072            "but it's present",
073        conn.getHeaderField("Strict-Transport-Security"), is((String)null));
074    assertThat("Header 'Content-Security-Policy' should be missing from response," +
075            "but it's present",
076        conn.getHeaderField("Content-Security-Policy"), is((String)null));
077  }
078
079  @Test
080  public void testHstsAndCspSettings() throws IOException {
081    Configuration conf = new Configuration();
082    conf.set("hbase.http.filter.hsts.value",
083        "max-age=63072000;includeSubDomains;preload");
084    conf.set("hbase.http.filter.csp.value",
085        "default-src https: data: 'unsafe-inline' 'unsafe-eval'");
086    http = createTestServer(conf);
087    http.start();
088    baseUrl = getServerURL(http);
089
090    URL url = new URL(baseUrl, "/");
091    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
092    assertThat(conn.getResponseCode(), equalTo(HttpURLConnection.HTTP_OK));
093
094    assertThat("Header 'Strict-Transport-Security' is missing from Rest response",
095        conn.getHeaderField("Strict-Transport-Security"), Is.is(not((String)null)));
096    assertThat("Header 'Strict-Transport-Security' has invalid value",
097        conn.getHeaderField("Strict-Transport-Security"),
098        IsEqual.equalTo("max-age=63072000;includeSubDomains;preload"));
099
100    assertThat("Header 'Content-Security-Policy' is missing from Rest response",
101        conn.getHeaderField("Content-Security-Policy"), Is.is(not((String)null)));
102    assertThat("Header 'Content-Security-Policy' has invalid value",
103        conn.getHeaderField("Content-Security-Policy"),
104        IsEqual.equalTo("default-src https: data: 'unsafe-inline' 'unsafe-eval'"));
105  }
106}