{"comment":{"url":"https://api.github.com/repos/vkorukanti/drill/comments/12840456","html_url":"https://github.com/vkorukanti/drill/commit/0a01dfdbe7bfe40a4f63a9dfbfdaaeb0d7830329#commitcomment-12840456","id":12840456,"user":{"login":"jacques-n","id":183350,"avatar_url":"https://avatars.githubusercontent.com/u/183350?v=3","gravatar_id":"","url":"https://api.github.com/users/jacques-n","html_url":"https://github.com/jacques-n","followers_url":"https://api.github.com/users/jacques-n/followers","following_url":"https://api.github.com/users/jacques-n/following{/other_user}","gists_url":"https://api.github.com/users/jacques-n/gists{/gist_id}","starred_url":"https://api.github.com/users/jacques-n/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jacques-n/subscriptions","organizations_url":"https://api.github.com/users/jacques-n/orgs","repos_url":"https://api.github.com/users/jacques-n/repos","events_url":"https://api.github.com/users/jacques-n/events{/privacy}","received_events_url":"https://api.github.com/users/jacques-n/received_events","type":"User","site_admin":false},"position":null,"line":null,"path":"","commit_id":"0a01dfdbe7bfe40a4f63a9dfbfdaaeb0d7830329","created_at":"2015-08-22T01:05:31Z","updated_at":"2015-08-22T01:05:31Z","body":"It really seems like this should be three separate proposed commits.  Here are some high level comments on each:\r\n\r\n- Add SSL to WebUI\r\nI'm inclined to switch Drill's default to always doing SSL.  We can do this by using a self-signed cert rather than having to configure a trust store.  If someone wants to control the server cert, then they would have to configure a trust store.\r\n\r\n- Make Rest API methods all use DrillClient\r\nAs discussed above, I don't think we should be creating a large number of additional RPC wire protocol items.  We should continue the existing pattern of minimizing API surface and using SQL for operations.  These operations are all things that people have also requested via SQL.  This allows us to have only one entry point for that code instead of multiple.\r\n\r\n- Add WebUI Authentication\r\nWe need to have a design discussion on JIRA around the method to securing the WebUI calls.  It seems like we're implementing a custom way to manage security around web requests (including the use of a customer filter and BaseModel.  There are a number of standard ways to provide this functionality that will probably be much easier to maintain and more secure.  For example Jersey has some built in capabilities. There is also a bunch of capabilities built into servlets and jetty around security constraints and context.   Especially for security, I'm inclined to use pre-existing solutions rather than implementing custom solutions.  \r\n"}}