abutaha/aws-es-proxy

API request to Kibana not including kbn-xsrf header

Closed this issue · 3 comments

kjorg50 commented

Hi, I'm trying to make an API request similar to the one described in this answer about updating index patterns. My proxy is running on port 9200 and then I try something like this

curl 'http://localhost:9200/_plugin/kibana/api/saved_objects/index-pattern/INDEX_ID' -X PUT -H 'Content-Type: application/json' -H "kbn-xsrf: true" --data-binary '{"attributes":{"title":"INDEX_NAME","fields":"[ESCAPED_JSON_LIST_OF_FIELDS]"}}'

However, I get this error

{"statusCode":400,"error":"Bad Request","message":"Request must contain a kbn-xsrf header."}

Even though that header is included in the request, I think it is not being passed through the proxy correctly. Can anyone help provide some insight here? Am I missing something?

dl-git commented

hi @kjorg50 - I faced a very similar issue trying to run filebeat setup
I'm not hugely familiar with go so I found an npm alternative
https://www.npmjs.com/package/amazon-elasticsearch-proxy

edited the file node_modules/amazon-elasticsearch-proxy/proxy.js
and added in a statement to include the kbn-xsrf header
(there's already one for the kbn-version header)

the very definition of a hacky workaround but solved the problem

abutaha commented

Hi,

Thanks for reporting this. Will release a fix soon.

  • 👍1
saravanan30erd commented

@kjorg50 @dl-git

You can also use the header kbn-version to solve this error.
Kibana UI uses kbn-version header to mitigate this issue

curl 'http://10.10.10.10:9200/_plugin/kibana/api/saved_objects/index-pattern/INDEX-PATEERN_ID' -X PUT -H 'Content-Type: application/json' --data-binary '{"attributes":{"title":"INDEX","fields":"[]"}}' -H "kbn-version: 7.4.2"

However Kibana recommends to use kbn-xsrf for API calls.
kbn-version header also used for the client-side Kibana version check that alerts users when their client is out of date and needs to be refreshed("error":"Bad Request","message":"Browser client is out of date, please refresh the page"), so it must match the version of Kibana exactly. This poses a problem for any programmatic access that would only get set up once but may run repeatedly throughout the future (e.g. watcher), so we need to use kbn-xsrf header
instead with static value in this case.

Added the support for kbn-xsrf header in proxy now,

curl 'http://10.10.10.10:9200/_plugin/kibana/api/saved_objects/index-pattern/INDEX-PATTERN_ID' -X PUT -H 'Content-Type: application/json' --data-binary '{"attributes":{"title":"INDEX","fields":"[]"}}' -H "kbn-xsrf: true"

  • 🎉2