You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CONTRIBUTING.md
+7-3Lines changed: 7 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,6 +7,10 @@ Contributing to Zeppelin (Source code, Documents, Image, Website) means you agre
7
7
2. If not, create a ticket describing the change you're proposing in the [Jira issue tracker](https://issues.apache.org/jira/browse/ZEPPELIN)
8
8
3. Contribute your patch via Pull Request.
9
9
10
+
Before you start, please read the [Code of Conduct](http://www.apache.org/foundation/policies/conduct.html) carefully, familiarize yourself with it and refer to it whenever you need it.
11
+
12
+
For those of you who are not familiar with Apache project, understanding [How it works](http://www.apache.org/foundation/how-it-works.html) would be quite helpful.
13
+
10
14
## Creating a Pull Request
11
15
In order to make the review process easier, please follow this template when making a Pull Request:
12
16
@@ -144,13 +148,13 @@ First of all, you need the Zeppelin source code. The official location for Zeppe
144
148
Get the source code on your development machine using git.
Copy file name to clipboardExpand all lines: SECURITY-README.md
+3-6Lines changed: 3 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -33,11 +33,8 @@ The scope of this PR is to require credentials to access Zeppelin. To achieve th
33
33
Apache Shiro sits as a servlet filter between the browser and the exposed services and handles the required authentication without any programming required. (See Apache Shiro for more info).
34
34
## Websocket security
35
35
Securing the HTTP endpoints is not enough, since Zeppelin also communicates with the browser through websockets. To secure this channel, we take the following approach:
36
-
1. The browser on startup requests a ticket through HTTP
37
-
2. The Apache Shiro Servlet filter handles the user auth
38
-
3. Once the user is authenticated, a ticket is assigned to this user and the ticket is returned to the browser
36
+
1. The browser on startup requests a ticket through HTTP
37
+
2. The Apache Shiro Servlet filter handles the user auth
38
+
3. Once the user is authenticated, a ticket is assigned to this user and the ticket is returned to the browser
39
39
40
40
All websockets communications require the username and ticket to be submitted by the browser. Upon receiving a websocket message, the server checks that the ticket received is the one assigned to the username through the HTTP request (step 3 above).
0 commit comments