How to set SameSite='None' in Kibana 7.6.2

gaetano · January 29, 2021, 11:26am

I'm using kibana 7.6.2 version and I tried to execute a cross-site domain access to Kibana bypassing login page.
After I launched http post call to Kibana login endpoint, attaching username and password,
I obtain a warning in Cookie section.

If I moved the mouse pointer to (i) of SameSite column, I get the following message back:
This Set-Cookie didn't specify a "SameSite" attributed and was defaulted to "SameSite=Lax" and was blocked because it came from a cross-site response which was not the response to a top-level navigation. The Set-Cookie had to have been set with "SameSite=None" to enable cross-site usage.

cookie

it seems that in version 7.6.2 the SameSite setting to None is not enabled, but in the http_tools.js there is a boolean variable isSameSite which by default is set to false.
How can I fix this bug?

mattkime · January 29, 2021, 3:31pm

Hello @gaetano

Generally speaking, its preferred to keep this in place as its more secure.

Why do you wish to make the cross site request?

gaetano · January 30, 2021, 5:48pm

Hi
I have a programming environment consisting of some virtual machines on which some web applications have been deployed. Solving this problem will allow me to connect between endpoints on different virtual machines.

mattkime · January 30, 2021, 7:44pm

I see - and how are you making the request to kibana? What does the request do and what are your aims?

gaetano · January 30, 2021, 7:48pm

my goal is to access kibana bypassing the login page by attaching username and password in the http post request

mattkime · January 30, 2021, 7:53pm

What does the request do? Are you using this to skip the login page and use kibana as normal or are you attempting to automate something?

Based on what you've said so far the best path would be to place a proxy in front of kibana so it can be served from the same ip or domain as the script you're trying to run but if you let me know what you're trying to do we might find something simpler.

mattkime · January 30, 2021, 8:04pm

You could also disable CORS enforcement in your browser although I wouldn't recommend it as a long term solution - Allow CORS: Access-Control-Allow-Origin - Chrome Web Store

gaetano · January 30, 2021, 8:09pm

I'm trying to use kibana as normal.
It is an Angular script that executes an http post call to 'internal/security/login' attaching username and password as body, and Content-Type: application/json and kbn-xsrf: 7.6.2 as http Header.

mattkime · January 30, 2021, 8:26pm

So you want to use kibana as normal but you want to skip the login screen?

gaetano · January 30, 2021, 8:55pm

yes my goal would be this. I don't know if it's possible.

mattkime · January 30, 2021, 9:01pm

Its definitely possible, its just a question of finding the best route since you're potentially creating a significant security hole. Have you considered using SAML authentication? It might provide a nice balance of security and convenience for you - Authentication in Kibana | Kibana Guide [7.10] | Elastic

gaetano · January 30, 2021, 9:22pm

Ok thank you for the attached link.
Anyway, for info, I tried to access Kibana by first launching the same http post call using the Talend Chrome extension. In that case I was able to access it bypassing the login page and I also noticed that the cookie was set.
While if I try to launch it via Angular script I am redirected to the login page and the cookie is not set.
For this reason I wanted to focus my topic on the theme of cookies, as in my opinion the problem had to be addressed and solved in this direction.

mattkime · January 30, 2021, 11:43pm

If I understand correctly, you're having success with the Talend extension but not your angular script, correct?

Can you share the request and response in each case?

gaetano · February 1, 2021, 10:02am

TALEND REQUEST - RESPONSE

SCRIPT REQUEST - RESPONSE

gaetano · February 1, 2021, 11:54am

I would also like to say that I have modified the http_tools.js file to enable CORS.
I inserted
cors: {additionalHeaders: ['kbn-version', 'kbn-xsrf', 'cookie'], origin: ['*'], credentials: true},
instead of
cors: config.cors

I thought that the problem could be caused by the CORS not enabled.

mattkime · February 1, 2021, 6:52pm

It looks like you found the solution - Allow for cookie's `SameSite` attribute to be configurable · Issue #60522 · elastic/kibana · GitHub - Chrome wants SameSite=None to be set which is supported in Kibana v7.8.1

From the requests you shared everything in the request and response is correct.

gaetano · February 2, 2021, 10:09am

Thank you. I finally decided to install Kibana 7.6.2 on the same domain as my web application. This way I can log into Kibana. The problem in upgrading the Hapi library (in Kibana 7.6.2), to enable the use of SameSite = 'None', is very complex. It becomes preferable, at that point, to install a newer version of Kibana.

gaetano · February 3, 2021, 6:25pm

Hi, I upgraded Kibana to version 7.10.2.
I added in kibana.yml
xpack.security.secureCookies: true
xpack.security.sameSiteCookies: None
for the SameSite setup, but when I try to access the login page I get this result.

login

While on the Cookie section I get this warning:
This Set-Cookie was blocked because it had the "Secure" attribute but was not received over a secure connection.

What changes do I have to make to establish a "secure" connection?