# No authorisation header is asked while consuming appsearch APIs

**URL:** <https://discuss.elastic.co/t/no-authorisation-header-is-asked-while-consuming-appsearch-apis/264026>\
**Category:** Elastic Search\
**Tags:** elastic-app-search\
**Created:** [February 11, 2021, 2:31pm UTC](https://discuss.elastic.co/t/no-authorisation-header-is-asked-while-consuming-appsearch-apis/264026 "2021-02-11T14:31:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nishad\_Angre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nishad_angre/32/83788_2.png) [@Nishad\_Angre](https://discuss.elastic.co/u/Nishad_Angre)\
**Post date:** [February 11, 2021, 2:31pm UTC](https://discuss.elastic.co/t/no-authorisation-header-is-asked-while-consuming-appsearch-apis/264026/1 "2021-02-11T14:31:54Z")

</div>

Hi all,

I have configured the appsearch and Elasticsearch using dockers on a Linux box.  
While I have have added data into the index using the latest webcrawler method, I could see that the APIs which require authorization as per the documentation from Elastic; in reality they work without that as well.

I tried to consume search API and click API.  
Both require Authorization header with basic auth key.  
But they return data without auth also.

Please help me understand whether I am doing anything wrong here??

PS: I am using version 7.11.0 for Elasticsearch and Appsearch with Nginx webserver and docker 19.03.13

---

<div class="post-metadata">

**Author:** ![Lyudmila\_Fokina](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lyudmila_fokina/32/77270_2.png) [@Lyudmila\_Fokina](https://discuss.elastic.co/u/Lyudmila_Fokina)\
**Post date:** [February 11, 2021, 2:45pm UTC](https://discuss.elastic.co/t/no-authorisation-header-is-asked-while-consuming-appsearch-apis/264026/2 "2021-02-11T14:45:21Z")

</div>

Starting with basics... Do you have Security enabled: xpack.security.enabled ([Security settings in Elasticsearch | Elasticsearch Reference [7.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-settings.html))?

---

<div class="post-metadata">

**Author:** ![Nishad\_Angre](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nishad_angre/32/83788_2.png) [@Nishad\_Angre](https://discuss.elastic.co/u/Nishad_Angre)\
**Post date:** [February 12, 2021, 2:12pm UTC](https://discuss.elastic.co/t/no-authorisation-header-is-asked-while-consuming-appsearch-apis/264026/3 "2021-02-12T14:12:27Z")

</div>

Hi @Lyudmila_Fokina,

This helped me. but now I am stuck with another issue.  
After I enabled the xpack.security.enabled: true in elasticsearch.yml, I had to enable and add below as well.

```auto
    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

```

But now i facing issues with elastic APIs.  
API consumed: /\_cat/nodes?v=true&pretty  
Response returned

```auto
    {

        "error": {

            "root_cause": [

                {

                    "type": "security_exception",

                    "reason": "missing authentication credentials for REST request [/_cat/nodes?v=true&pretty]",

                    "header": {

                        "WWW-Authenticate": "Basic realm=\"security\" charset=\"UTF-8\""

                    }

                }

            ],

            "type": "security_exception",

            "reason": "missing authentication credentials for REST request [/_cat/nodes?v=true&pretty]",

            "header": {

                "WWW-Authenticate": "Basic realm=\"security\" charset=\"UTF-8\""

            }

        },

        "status": 401

    }

```

Kindly help me understand and resolve this hurdle.

---

<div class="post-metadata">

**Author:** ![orhantoy](https://avatars.discourse-cdn.com/v4/letter/o/c5a1d2/32.png) [@orhantoy](https://discuss.elastic.co/u/orhantoy)\
**Post date:** [February 14, 2021, 11:15pm UTC](https://discuss.elastic.co/t/no-authorisation-header-is-asked-while-consuming-appsearch-apis/264026/4 "2021-02-14T23:15:49Z")

</div>

@Nishad_Angre In a local setup it should be enough with

```auto
xpack.security.enabled: true
xpack.security.authc.api_key.enabled: true

```

And then when you request something like `/_cat/nodes?v=true&pretty` you would need to provide the credentials to Elasticsearch.  
Perhaps this guide can be of help: [link](https://www.elastic.co/guide/en/elasticsearch/reference/7.11/security-getting-started.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2021, 11:16pm UTC](https://discuss.elastic.co/t/no-authorisation-header-is-asked-while-consuming-appsearch-apis/264026/5 "2021-03-14T23:16:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.