As I understand, Shiro offers TLS level security to protect Zeppelin traffic. We could also make use of Nginx configurations to front load the entrypoint and control the transport layer security.
I believe with respect to the communcation there are three components involved 1) Zeppelin web application framework (Jetty) 2) Websocket layer (Notebook Socket) 3) Remote interpreter communication layer (Apache Thrift) Does Shiro protects TLS across all these layers (I think 1 & 2 is protected)? If not, what components are not protected and are there any plans (Jira) to tackle the issue. Regards Vijay -- View this message in context: http://apache-zeppelin-incubating-dev-mailing-list.75694.x6.nabble.com/Zeppelin-Security-tp8874.html Sent from the Apache Zeppelin (incubating) dev mailing list mailing list archive at Nabble.com.
