github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 09:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

Updates header filters for request logs. (#162062)

Browse source 
## Summary

Updates
[header](https://www.elastic.co/guide/en/elasticsearch/reference/master/jwt-auth-realm.html#hmac-oidc-example-request-headers)
filters for request logs.

/cc @elastic/kibana-security
This commit is contained in:
Aleh Zasypkin 2023-07-18 10:56:07 +02:00 • committed by GitHub
parent e1352db526
commit 303575544a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 46 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

17
packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.test.ts
View file

@ -91,6 +91,23 @@ describe('getEcsResponseLog', () => {
`);
});
test('redacts es-client-authentication headers by default', () => {
const event = createResponseEvent({
requestParams: {
headers: { 'es-client-authentication': 'ae3fda37-xxx', 'user-agent': 'world' },
},
response: { headers: { 'content-length': '123' } },
});
const log = getEcsResponseLog(event);
// @ts-expect-error ECS custom field
expect(log.http.request.headers).toMatchInlineSnapshot(`
Object {
"es-client-authentication": "[REDACTED]",
"user-agent": "world",
}
`);
});
test('does not mutate original headers', () => {
const reqHeaders = { a: 'foo', b: ['hello', 'world'] };
const resHeaders = { c: 'bar' };

8
packages/core/elasticsearch/core-elasticsearch-client-server-internal/src/get_ecs_response_log.ts
View file

@ -12,7 +12,13 @@ import { type LogMeta } from '@kbn/logging';
// If you are updating these, consider whether they should also be updated in the
// http service `getResponseLog`
const FORBIDDEN_HEADERS = ['authorization', 'cookie', 'set-cookie', 'x-elastic-app-auth'];
const FORBIDDEN_HEADERS = [
'authorization',
'cookie',
'set-cookie',
'x-elastic-app-auth',
'es-client-authentication',
];
const REDACTED_HEADER_TEXT = '[REDACTED]';
// We are excluding sensitive headers by default, until we have a log filtering mechanism.

15
packages/core/http/core-http-server-internal/src/logging/get_response_log.test.ts
View file

@ -211,6 +211,21 @@ describe('getEcsResponseLog', () => {
`);
});
test('redacts es-client-authentication headers by default', () => {
const req = createMockHapiRequest({
headers: { 'es-client-authentication': 'ae3fda37-xxx', 'user-agent': 'world' },
response: { headers: { 'content-length': '123' } },
});
const result = getEcsResponseLog(req, logger);
// @ts-expect-error ECS custom field
expect(result.meta.http.request.headers).toMatchInlineSnapshot(`
Object {
"es-client-authentication": "[REDACTED]",
"user-agent": "world",
}
`);
});
test('does not mutate original headers', () => {
const reqHeaders = { a: 'foo', b: ['hello', 'world'] };
const resHeaders = { headers: { c: 'bar' } };

8
packages/core/http/core-http-server-internal/src/logging/get_response_log.ts
View file

@ -16,7 +16,13 @@ import { getResponsePayloadBytes } from './get_payload_size';
// If you are updating these, consider whether they should also be updated in the
// elasticsearch service `getEcsResponseLog`
const FORBIDDEN_HEADERS = ['authorization', 'cookie', 'set-cookie', 'x-elastic-app-auth'];
const FORBIDDEN_HEADERS = [
'authorization',
'cookie',
'set-cookie',
'x-elastic-app-auth',
'es-client-authentication',
];
const REDACTED_HEADER_TEXT = '[REDACTED]';
type HapiHeaders = Record<string, string | string[]>;