Why Copy & Paste Fails in CFM 4 / NiFi 2.x

Users on Cloudera CFM 4 occasionally report that Copy / Paste in the NiFi UI does not work. The first suspicion is usually NiFi permissions, but the real cause lies outside NiFi.

In short: NiFi 2.x uses the browser Clipboard API, which is only available in a secure context (HTTPS). The problem shows up mainly when NiFi is accessed over plain HTTP in a non-secure deployment.

http://node3.cfm4.lab.data-dynamics.io:8080

Why it is not a NiFi permissions issue

A non-secure NiFi cluster performs no authentication and no authorization at all. There is simply no mechanism restricting UI actions per user, so none of the following can explain the symptom.

• User authentication
• User authorization
• Access policies
• Processor or process group permissions

The cause is browser security policy, not NiFi configuration.

How clipboard works in NiFi 2.x

NiFi 2.x, shipped with CFM 4, relies on the browser Clipboard API to implement copy and paste.

navigator.clipboard

When you trigger Copy in the NiFi UI, the data is written to the browser clipboard through that API.

The browser secure context restriction

Chrome and other modern browsers restrict navigator.clipboard to secure contexts for security reasons. A page loaded over HTTPS generally qualifies as a secure context.

So when NiFi is served over HTTP, the browser can block the Clipboard API outright.

Behavior by access method

Browsers treat localhost as an exception close to a secure context. That is a trap: the same NiFi can look perfectly healthy when accessed locally.

Fix 1 — Force the HTTP origin to be treated as secure in Chrome

In test and development environments you can tell Chrome to treat a specific HTTP URL as a secure context. Cloudera has confirmed that copy/paste works with this setting in their test environment.

1. Open the Chrome flags page

Enter the following in the address bar.

chrome://flags/#unsafely-treat-insecure-origin-as-secure

2. Enable "Insecure origins treated as secure"

Find the Insecure origins treated as secure entry and change its value to Enabled.

3. Register the NiFi URL

Type the NiFi URL into the text box of that entry.

http://node3.cfm4.lab.data-dynamics.io:8080

The browser operates on origins, not URLs. An origin is the combination of protocol + host + port.

4. When you connect directly to multiple cluster nodes

If you need to reach each NiFi cluster node URL directly, register every origin. From the browser's point of view these are three distinct origins.

http://node1.cfm4.lab.data-dynamics.io:8080
http://node2.cfm4.lab.data-dynamics.io:8080
http://node3.cfm4.lab.data-dynamics.io:8080

5. Relaunch Chrome

Click the Relaunch button at the bottom of the page, then reconnect to NiFi and test copy/paste.

Procedure at a glance

Fix 2 — Configure TLS on NiFi

If you would rather not touch browser settings, configure TLS on NiFi and access it over HTTPS.

http://nifi.example.com:8080
        ↓
https://nifi.example.com        (or https://nifi.example.com:8443)

With HTTPS the browser recognizes the NiFi page as a secure context, navigator.clipboard becomes usable, and copy/paste is restored.

TLS with authentication and authorization

When browser settings are not to be changed, Cloudera recommends a secure NiFi deployment.

This goes beyond fixing the clipboard: it puts NiFi itself into secure mode, which gets you

• HTTPS transport
• a browser secure context
• a working Clipboard API
• user authentication and per-user authorization
• a hardened NiFi UI

Comparing the two approaches

Recommendation by environment

Look at the name of the Chrome setting again.

unsafely-treat-insecure-origin-as-secure

It says exactly what it does: it forces the browser to treat an insecure HTTP origin as a secure context. Rolling that out to every user's browser in production is worse than configuring TLS on NiFi itself.

The whole picture

Summary

Copy/paste failures on CFM 4 / NiFi 2.x are not about user permissions on a non-secure NiFi. They come from the secure context restriction on the browser Clipboard API.

As a short-term fix, register the NiFi HTTP URL as a secure origin under chrome://flags/#unsafely-treat-insecure-origin-as-secure. But that is a browser-side exception; the real fix for production is TLS on NiFi and access over HTTPS.

Use the Chrome flag for development and test. For production, go with HTTPS-based NiFi backed by TLS, authentication, and authorization.