roryqi opened a new issue, #13936: URL: https://github.com/apache/gravitino/issues/13936
### Version main branch ### Describe whats wrong `JettyServer` registers `/metrics` and `/prometheus/metrics` on every listener it starts, including the Iceberg REST and Lance REST services. Authentication filters are bound to the API paths, so these metrics endpoints can respond without credentials on the auxiliary service ports. When those ports are reachable by external clients, the endpoints may disclose request metrics, JVM state, and catalog or metalake names. ### Error message and/or stacktrace Not applicable. ### How to reproduce 1. Start Gravitino with the Iceberg REST or Lance REST service enabled. 2. Send an unauthenticated request to `/metrics` or `/prometheus/metrics` on that services port. 3. Observe that the endpoint responds without authentication. ### Additional context Metrics can remain available on the main server for in-cluster scraping. The auxiliary service listeners should not expose these endpoints, or the endpoints should require authentication. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
