# Can hacker use search api endpoint to update document or delete index?
**URL:** https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [October 19, 2022, 3:53pm UTC](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027 "2022-10-19T15:53:04Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@jbond](https://discuss.elastic.co/u/jbond)
#### Post date: [October 19, 2022, 3:53pm UTC](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027/1 "2022-10-19T15:53:04Z")
My company use free version of Elasticsearch software so no security on it. Our Elasticsearch server is running on internal network and internet user cannot access to it. We have a public app need to call Elasticsearch API to fetch some data. Therefore, I use api gateway/reverse proxy to expose one index's search api endpoint.
[http://apigateway.my.com/api/search](http://apigateway.my.com/api/search) (public)--\> [http://myelasticserver:9200/myindex/\_search](http://myelasticserver:9200/myindex/_search) (internal)
So whenever somebody hit [http://apigateway.my.com/api/search](http://apigateway.my.com/api/search) with POST body, the request will forward to the internal search api.
My concern is data integrity. data is public and I don't mind user view the whole data. But I don' t want user to update record or delete index through the search api endpoint [http://myelasticserver:9200/myindex/\_search](http://myelasticserver:9200/myindex/_search). Technically, user can post anything to the search api endpoint.
can anybody confirm that the index search api endpoint is read only? Thanks!
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [October 19, 2022, 9:45pm UTC](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027/2 "2022-10-19T21:45:49Z")
> [@jbond](#):
>
> My company use free version of Elasticsearch software so no security on it
The Security functionality has been free for quite a number of years now, why are you not using it?
---
### Author:  [@devwmo](https://discuss.elastic.co/u/devwmo)
#### Post date: [October 19, 2022, 11:22pm UTC](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027/3 "2022-10-19T23:22:07Z")
Need to configure privileges on a given user role. Configuring via Kibana: Kibana \> Stack Management \> Roles \> Privileges.
Setting to be given for the user role is "read". As a result, methods such as PUT or POST cannot be used.
---
### Author:  [@jbond](https://discuss.elastic.co/u/jbond)
#### Post date: [October 19, 2022, 11:36pm UTC](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027/4 "2022-10-19T23:36:09Z")
I don' t know that. Will try! Thanks for the response!
---
### Author:  [@jbond](https://discuss.elastic.co/u/jbond)
#### Post date: [October 20, 2022, 2:11am UTC](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027/5 "2022-10-20T02:11:01Z")
Thanks Devwmo!
I did another research. Index Block is the easiest way.
> **[Index blocks | Elasticsearch Guide \[7.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/index-modules-blocks.html#add-index-block-api-path-params)**
>
---
### Author:  [@eguenou](https://discuss.elastic.co/u/eguenou)
#### Post date: [October 20, 2022, 2:19pm UTC](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027/6 "2022-10-20T14:19:36Z")
Moreover, if you want to check all the roles available, you can use this command:
```auto
GET /_security/role/
```
Public-accessed applications' users/roles should only have the 'read' privilege.
---
### Author:  [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)
#### Post date: [October 23, 2022, 11:52pm UTC](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027/7 "2022-10-23T23:52:58Z")
> [@jbond](#):
>
> Index Block is the easiest way.
Index blocks prevent certain operations from all users. That is, if read-only block is set, no one can write to the index including your admin users. Depending on your use case, this may or may not be an issue.
> can anybody confirm that the index search api endpoint is read only?
It should be read only. It will be a bug if it can be used for any mutation.
For your use case, I think turning on security and [enabling anonymous access](https://www.elastic.co/guide/en/elasticsearch/reference/current/anonymous-access.html) with read only privilege are probably your best bet. It means you get full security protections and extrenal users can only ever read data (via anonymous access).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 20, 2022, 11:53pm UTC](https://discuss.elastic.co/t/can-hacker-use-search-api-endpoint-to-update-document-or-delete-index/317027/8 "2022-11-20T23:53:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.