No. The Spark security documentation states that Spark does not provide any built-in authentication filters for the web UI, so you must install one. Access control lists only take effect when a filter is present. Until then, network controls decide who can see the UI.
What the docs say
The relevant statements are short.
- Spark does not provide any built-in authentication filters. You supply a servlet filter.
- A JWT-based filter, org.apache.spark.ui.JWSFilter, is available. You configure it with a Base64URL-encoded key through the spark.ui.filters setting.
- ACLs depend on a filter. The docs say that if no authentication filter is installed, the ACL option does nothing.
- The related settings are spark.acls.enable, spark.ui.view.acls and spark.modify.acls, along with a group mapping setting.
The default group mapping is a Unix shell-based implementation, and the docs state Windows is not supported for it.
Why the UI matters
A Spark UI can show application details, configuration, environment properties and logs. Even when a deployment hides secrets with redaction, the page can show job structure, file paths and hostnames. Redaction also has limits, covered in the Spark redaction post on this blog.
An unauthenticated UI reachable from outside is useful reconnaissance for someone else.
A hardening sequence
- Confirm who can reach the UI ports today. The docs list 4040 for application UIs, 8080 and 8081 for standalone UIs and 18080 for the history server.
- Restrict those ports to the networks that need them.
- Install an authentication filter. Use your identity provider through a proxy, or the JWT filter if it fits.
- Enable ACLs only after the filter is in place, then test with an account that should be denied.
- Turn on TLS for the UI. The docs show SSL options for the UI and note that a protocol must be set when SSL is enabled.
- Review the hardening headers. The docs list settings for content type options, strict transport security and a content security policy, which defaults to off.
A test that takes ten minutes
From a machine outside the allowed network, try to open the UI port. From an allowed machine without credentials, try again. Both should fail once the filter and firewall are in place. Write down the results as evidence.
Where this connects to dependencies
The web UI is a piece of software too, with its own advisory history in the Spark project and the libraries it ships with. Keep Spark itself patched, and track advisories for the version you run. An authenticated, non-public UI also lowers the chance that a UI-level flaw becomes your incident.
Safeguard's SBOM and dependency scanning can inventory the Spark version and libraries in your images, and its asset discovery can help you find clusters you forgot. The free scan at https://gold.safeguard.sh/scan is a quick starting point.
Quick check
If I set ACLs, is the UI protected?
Not on its own. The docs say ACLs do nothing unless an authentication filter is installed.
Is TLS the same as authentication?
No. TLS encrypts traffic. You still need a filter to decide who may connect.
Sources
Last reviewed: 19 October 2026.
