# CORS configuration for authenticated users through access\_by\_lua\_file

**URL:** <https://discuss.elastic.co/t/cors-configuration-for-authenticated-users-through-access-by-lua-file/134183>\
**Category:** Elasticsearch\
**Created:** [June 1, 2018, 9:10am UTC](https://discuss.elastic.co/t/cors-configuration-for-authenticated-users-through-access-by-lua-file/134183 "2018-06-01T09:10:34Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bialy\_rb](https://avatars.discourse-cdn.com/v4/letter/b/b9e5f3/32.png) [@bialy\_rb](https://discuss.elastic.co/u/bialy_rb)\
**Post date:** [June 1, 2018, 9:10am UTC](https://discuss.elastic.co/t/cors-configuration-for-authenticated-users-through-access-by-lua-file/134183/1 "2018-06-01T09:10:35Z")

</div>

Apologies if this post shouldn't be here and would be grateful;l if you point me in the right direction.

I hope I can get some help here as I'm struggling to get it solved.

We're using openresty as proxy service to elasticsearch back-end. Elasticsearch is available on **_[https://es.example.com](https://es.example.com)_**  
and configs used for setting access are as follow:

1. **_/usr/local/openresty/nginx/conf/nginx.conf_**

2. **_/usr/local/openresty/nginx/sites/es.example.com.conf_**

3. **_/usr/local/openresty/nginx/authorize/elasticsearch/authorize.lua_**

we're looking at enabling cors option to allow access from domain [https://kibana.domain.com](https://kibana.domain.com) to **_[https://es.example.com](https://es.example.com)_**  
The following changes were applied to elasticsearch config (es ver 2.4)  
**_/etc/elasticsearch/elasticsearch.yml_**

```
...
http.cors.enabled: true
http.cors.allow-origin: "kibana.domain.com"
http.cors.allow-credentials: true
http.cors.allow-methods: "DELETE, GET, HEAD, OPTIONS, POST, PUT"
http.cors.allow-headers: "Origin, Accept, Content-Type, Content-Length, Authorization, X-Requested-With"
http.cors.max-age: 1728000

```

If authentication is disabled I can access elasticsearch but not with authentication enabled (using ' **_access\_by\_lua\_file_**' module and user admin).  
I have tried different options in server section of nginx config e.g.:

**_/usr/local/openresty/nginx/sites/es.example.com.conf_**  
...  
add\_header 'Access-Control-Allow-Origin' '[https://kibana.domain.com](https://kibana.domain.com)' always;  
add\_header 'Access-Control-Allow-Credentials' 'true' always;  
add\_header 'Access-Control-Request-Method' 'OPTIONS' always;  
add\_header 'Access-Control-Allow-Methods' 'DELETE, GET, HEAD, OPTIONS, POST, PUT' always;  
add\_header 'Access-Control-Allow-Headers' 'Origin, Accept, Content-Type, Authorization, X-Requested-With' always;  
add\_header 'Access-Control-Request-Headers' 'Authorization, X-Requested-With' always;  
}  
}

or

**_/usr/local/openresty/nginx/sites/es.example.com.conf_**  
...  
proxy\_set\_header 'Access-Control-Allow-Origin' '[https://kibana.domain.com](https://kibana.domain.com)';  
proxy\_set\_header 'Access-Control-Allow-Credentials' 'true';  
proxy\_set\_header 'Access-Control-Allow-Methods' 'DELETE, GET, HEAD, OPTIONS, POST, PUT';  
proxy\_set\_header 'Access-Control-Allow-Headers' 'Origin,Accept,Content-Length,Authorization,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';  
}  
}

and errors i get are:  
_**- CORS header ‘Access-Control-Allow-Origin’ does not match ‘(null)’**_  
_ **- CORS preflight channel did not succeed** _  
_ **- CORS header ‘Access-Control-Allow-Origin’ missing** _

Is it something that has to be enabled in '/usr/local/openresty/nginx/authorize/elasticsearch/authorize.lua' script or another nginx module has to be involved?

Any help, pointers would be greatly appreciated

Rafal

---

<div class="post-metadata">

**Author:** ![Bill\_McConaghy](https://avatars.discourse-cdn.com/v4/letter/b/ed655f/32.png) [@Bill\_McConaghy](https://discuss.elastic.co/u/Bill_McConaghy)\
**Post date:** [June 1, 2018, 3:17pm UTC](https://discuss.elastic.co/t/cors-configuration-for-authenticated-users-through-access-by-lua-file/134183/2 "2018-06-01T15:17:29Z")

</div>

Sorry Kibana forum is not the place to ask, but also not sure where to ask. Maybe the Elasticsearch forum?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2018, 3:17pm UTC](https://discuss.elastic.co/t/cors-configuration-for-authenticated-users-through-access-by-lua-file/134183/3 "2018-06-29T15:17:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.