Unable to execute POST request to Kibana

peternijem · August 22, 2020, 4:54pm

Hi,

I've built a UI that executes REST API for creating user, role, and a space in Kibana.
But, the POST requests fail due to CORS poilicy:

In the kibana.yml I have the following:
server.cors: true
server.cors.origin: ["*"]

I am using Elastic Stack 7.5.1

Please advise.

Thanks,
Peter

peternijem · August 24, 2020, 12:39pm

I would appreciate your help. It is a blocker for me.

mattkime · August 25, 2020, 6:33pm

Hello @peternijem

I don't see documentation for the configurations you cite. Can you show me where you found them? Do you intend to send the request to Kibana or Elasticsearch?

peternijem · August 26, 2020, 6:35am

Hi @mattkime

Yeah maybe I grabbed these configurations from documentation of older Kibana release:
server.cors: true
server.cors.origin: ["*"]

Anyway, what I am trying to achieve is really simple. We have deployed open-source Kibana 7.5.1 and I want to trigger POST/PUT endpoints for creating Space, Role, User etc.
This is part of some web-application project. When I try to create a Space for example, I get the error I mentioned above. It is CORS issue. Apparently Kibana is not allowing cross-origin requests.
The questions is: how can I enable it? I have access to kibana.yml and Kibana code.

Please assist here because it is a major blocker for the use of Kibana in production.

REST API for creating a space on Kibana 7.5:
https://www.elastic.co/guide/en/kibana/7.5/spaces-api-post.html

I see there is server.xsrf.whitelist configuration that may help (https://www.elastic.co/guide/en/kibana/7.5/settings.html). But I am not sure how to do so.

Maybe also server.xsrf.disableProtection: true? (documentation is bad )
Anyway, I am sending on my request the header kbn-xsrf: true

Peter

peternijem · August 26, 2020, 11:57am

Update

Tried all the following:

server.cors: true
server.cors.origin: ["*"]
server.xsrf.whitelist: ["/api/spaces/space"]
server.xsrf.disableProtection: true

Nothing helped. I am still getting the same error when trying to execute POST request to /api/spaces/space

I have no other idea. Please assist

mattkime · August 26, 2020, 2:24pm

I suspect those options were removed to increase the security of kibana.

You have a couple of options -

place your app behind the same domain as kibana
develop a kibana plugin
use a use a proxy to forward requests to kibana

peternijem · August 26, 2020, 6:11pm

Thanks. But, as I've said already Kibana's documentation is bad.
Most of the configurations I've tried are part of Kibana 7.5 official documentation.
Please update your documentation. This will save users/developers lots of precious time.

Thanks,
Peter

peternijem · August 26, 2020, 6:13pm

BTW, how come I don't have this issue with GET requests?
In my app I mentioned before, I can execute GET requests without any issue. But neither POST or PUT.

mattkime · August 26, 2020, 6:15pm

Most of the configurations I've tried are part of Kibana 7.5 official documentation.
Please update your documentation. This will save users/developers lots of precious time.

Can you be more specific about what is incorrect about the documentation? Here's a link to the 7.5 configuration docs - Configuring Kibana | Kibana Guide [7.5] | Elastic

peternijem · August 26, 2020, 6:30pm

For instance, I can see server.xsrf.whitelist configuration. It is part of the documentation. It is always good to add an example of how to use each property. In my case, I've added as such:
server.xsrf.whitelist: ["/api/spaces/space"]
But it didn't help. Not sure why. Can you maybe assist me with that? Is it even the right direction for overcoming my issue?

Another example, it's the documentation of using REST API of Kibana 7.5. Here: https://www.elastic.co/guide/en/kibana/7.5/using-api.html#api-request-headers

server.xsrf.disableProtection configuration is mentioned although it is not on the page you've sent. So documentation is inconsistent.

peternijem · August 26, 2020, 6:41pm

I am pretty sure there is another solution for my issue. Especially taking into consideration that GET requests are working as expected.
Only the third option is feasible in my case but requires more work from other teams.
I really prefer to fix this issue on my side only without additional requirements and complications.

mattkime · August 26, 2020, 6:48pm

Can you post a HAR file showing succeeding and failing request attempts? I think starting with server.xsrf.disableProtection: true makes sense

I created the following issue regarding documentation - https://github.com/elastic/kibana/issues/76017

peternijem · August 26, 2020, 7:14pm

Yeah but server.xsrf.disableProtection: true didn't help.

With which configuration of Kibana you want me to record the requests sent from my app?

mattkime · August 26, 2020, 7:18pm

Start with server.xsrf.disableProtection: true - it seems it should work.

peternijem · August 29, 2020, 11:46am

Hi,

I've tried what you've suggested. Now even GET requests don't work!

This is one of the GET requests I use:
https://www.elastic.co/guide/en/kibana/7.5/features-api-get.html

Below is the error from the console:
app:1 Access to XMLHttpRequest at 'http://10.100.0.207:5604/api/features' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Below is the link for the HAR file which includes the GET and POST requests:

Larry_Gregory · September 1, 2020, 12:25pm

Hey @peternijem,

Sorry you're having a hard time with cross-origin requests to Kibana.

I see in the HAR file that you're making a request to POST http://10.100.0.207:5604/_security/user/peteruser.

Is this your Kibana endpoint? If so, the API to create a user in 7.5 is /api/security/v1/users/{username} (source link).

I also see a request to http://10.100.0.207:5604/api/features, which is returning a 404. Do you have security enabled for Kibana? If so, what user are you authenticating with? If the user does not have sufficient privileges (effectively the kibana_user role), then this endpoint can return a 404.

I know you tried a lot of config combinations. Does the following help any?

server.cors: true
# do not set server.cors.origin

server.xsrf.disableProtection: true

peternijem · September 1, 2020, 12:34pm

I will try it.
Can I change any part in the code to enable CORS?
FYI, I am using open-source Kibana 7.5.1

Thanks

Larry_Gregory · September 1, 2020, 1:34pm

Can you clarify this? If you're using the Apache-2.0 licensed version of Kibana, then your installation doesn't have the concept of a User, Role, or Space. These are all free features available with the "Default Distribution", which is granted under the Elastic License.

Do you see the "Space Avatar" at the top of Kibana?

If so, then you're running the Default Distribution, rather than the Open Source Distribution.

Setting server.cors: true should be sufficient to allow browsers to honor cross-origin requests. Setting server.xsrf.disableProtections: true should be sufficient to tell Kibana that you don't wish to protect the installation from cross-site request forgery. This should be a short-term solution, until we get it working. Then, we can move to the whitelist that you attempted earlier.

peternijem · September 1, 2020, 1:36pm

I see the Space Avatar. We've cloned Kibana 7.5.1 from the official GitHub page.

Larry_Gregory · September 1, 2020, 1:41pm

Thanks for clarifying. We don't recommend cloning the repository unless you're developing a Kibana plugin. If you're just looking to run Kibana, then I'd recommend downloading the built distributable here: Kibana 7.5.1 | Elastic

That aside, let me know how you make out with my earlier recommendation.