github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[server/xsrf] require more explicit command to disable xsrf

Browse source
This commit is contained in:
spalger 2015-11-09 11:31:24 -06:00
parent 9ec5a2c21f
commit d8aabbbb13
4 changed files with 12 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/plugins/elasticsearch/lib/__tests__/routes.js
View file

@ -15,7 +15,9 @@ describe('plugins/elasticsearch', function () {
kbnServer = new KbnServer({
server: {
autoListen: false,
xsrfToken: false
xsrf: {
disableProtection: true
}
},
logging: { quiet: true },
plugins: {

9
src/server/config/schema.js
View file

@ -41,11 +41,10 @@ module.exports = () => Joi.object({
}),
otherwise: Joi.boolean().default(false)
}),
xsrfToken: Joi
.alternatives()
.try(Joi.string())
.try(Joi.allow(false))
.default(randomBytes(256).toString('hex'))
xsrf: Joi.object({
token: Joi.string().default(randomBytes(256).toString('hex')),
disableProtection: Joi.boolean().default(false),
}).default(),
}).default(),
logging: Joi.object().keys({

2
src/server/http/__tests__/xsrf.js
View file

@ -11,7 +11,7 @@ const fromFixture = resolve.bind(null, __dirname, '../../../fixtures/');
describe('xsrf request filter', function () {
async function makeServer(token, ssl) {
const kbnServer = new KbnServer({
server: { autoListen: false, xsrfToken: token, ssl: ssl },
server: { autoListen: false, ssl: ssl, xsrf: { token } },
logging: { quiet: true },
optimize: { enabled: false },
});

8
src/server/http/xsrf.js
View file

@ -1,7 +1,9 @@
import { forbidden } from 'boom';
export default function (kbnServer, server, config) {
const token = config.get('server.xsrfToken');
const token = config.get('server.xsrf.token');
const disabled = config.get('server.xsrf.disableProtection');
const stateOpts = {
isSecure: Boolean(config.get('server.ssl.cert') && config.get('server.ssl.key')),
isHttpOnly: false,
@ -9,9 +11,7 @@ export default function (kbnServer, server, config) {
};
server.ext('onPostAuth', function (req, reply) {
if (!token) {
return reply.continue();
}
if (disabled) return reply.continue();
if (req.method === 'get' && !req.state['XSRF-TOKEN'] && !req.headers['x-xsrf-token']) {
reply.state('XSRF-TOKEN', token, stateOpts);