API request to Kibana not including kbn-xsrf header

[kjorg50]

Hi, I'm trying to make an API request similar to the one described in this answer about updating index patterns. My proxy is running on port 9200 and then I try something like this

curl 'http://localhost:9200/_plugin/kibana/api/saved_objects/index-pattern/INDEX_ID' -X PUT -H 'Content-Type: application/json' -H "kbn-xsrf: true" --data-binary '{"attributes":{"title":"INDEX_NAME","fields":"[ESCAPED_JSON_LIST_OF_FIELDS]"}}'

However, I get this error

{"statusCode":400,"error":"Bad Request","message":"Request must contain a kbn-xsrf header."}

Even though that header is included in the request, I think it is not being passed through the proxy correctly. Can anyone help provide some insight here? Am I missing something?

[dl-git]

hi @kjorg50 - I faced a very similar issue trying to run filebeat setup
I'm not hugely familiar with go so I found an npm alternative
https://www.npmjs.com/package/amazon-elasticsearch-proxy

edited the file node_modules/amazon-elasticsearch-proxy/proxy.js
and added in a statement to include the kbn-xsrf header
(there's already one for the kbn-version header)

the very definition of a hacky workaround but solved the problem

[abutaha]

Hi,

Thanks for reporting this. Will release a fix soon.

[saravanan30erd]

@kjorg50 @dl-git

You can also use the header kbn-version to solve this error.
Kibana UI uses kbn-version header to mitigate this issue

curl 'http://10.10.10.10:9200/_plugin/kibana/api/saved_objects/index-pattern/INDEX-PATEERN_ID' -X PUT -H 'Content-Type: application/json' --data-binary '{"attributes":{"title":"INDEX","fields":"[]"}}' -H "kbn-version: 7.4.2"

However Kibana recommends to use kbn-xsrf for API calls.
kbn-version header also used for the client-side Kibana version check that alerts users when their client is out of date and needs to be refreshed("error":"Bad Request","message":"Browser client is out of date, please refresh the page"), so it must match the version of Kibana exactly. This poses a problem for any programmatic access that would only get set up once but may run repeatedly throughout the future (e.g. watcher), so we need to use kbn-xsrf header
instead with static value in this case.

Added the support for kbn-xsrf header in proxy now,

curl 'http://10.10.10.10:9200/_plugin/kibana/api/saved_objects/index-pattern/INDEX-PATTERN_ID' -X PUT -H 'Content-Type: application/json' --data-binary '{"attributes":{"title":"INDEX","fields":"[]"}}' -H "kbn-xsrf: true"