Presto: Presto WebUI - authorization (security)
enable 2 roles (admin, user). Users in 'user' role can only see their queries on the WebUI whereas users in 'admin' role can see all queries on the WebUI. The reason for hiding other users queries is that they may have sensitive data: ie select * from persontbl where name = 'john smith' and address='123 smith st' + the UI reveals the count of rows returned by the query - thus allowing sensitive data to be revealed to other users.
tooptoop4
All 5 comments
Also would be nice to have a config setting to disable WebUI altogether
tooptoop4
on 5 Sep 2018
There should be hooks in SystemAccessControl (or a new interface created specifically for this purpose) allowing to filter/control access in the UI.
The roles (be it "admin", "user" or anything) would be up to the implementation of the interface.
findepi
on 6 Sep 2018
tooptoop4
on 6 Dec 2019
Do we have any update how we can stop seeing each other quires from Presto-ui.
Because of this we have got couple of security incidents in our environments.
dipanjanmukherjee83
on 27 Feb 2020
@dipanjanmukherjee83 use prestosql
tooptoop4
on 13 Jul 2020
Related issues
xerial
路
3Comments
tesseract2048
路
3Comments
aandis
路
4Comments
electrum
路
4Comments
tomz
路
3Comments
Most helpful comment
There should be hooks in
SystemAccessControl(or a new interface created specifically for this purpose) allowing to filter/control access in the UI.The roles (be it "admin", "user" or anything) would be up to the implementation of the interface.