Merge pull request elastic#7696 from lukasolson/fix/allow-head

Allow HEAD requests without kbn-version header

Former-commit-id: 27c027c

src/server/http/__tests__/xsrf.js

@@ -3,7 +3,7 @@ import { fromNode as fn } from 'bluebird';
 import { resolve } from 'path';
 import * as kbnTestServer from '../../../../test/utils/kbn_server';
 
-const nonDestructiveMethods = ['GET'];
+const nonDestructiveMethods = ['GET', 'HEAD'];
 const destructiveMethods = ['POST', 'PUT', 'DELETE'];
 const src = resolve.bind(null, __dirname, '../../../../src');
 
@@ -28,9 +28,10 @@ describe('xsrf request filter', function () {
 
     await kbnServer.ready();
 
+    const routeMethods = nonDestructiveMethods.filter(method => method !== 'HEAD').concat(destructiveMethods);
     kbnServer.server.route({
       path: '/xsrf/test/route',
-      method: [...nonDestructiveMethods, ...destructiveMethods],
+      method: routeMethods,
       handler: function (req, reply) {
         reply(null, 'ok');
       }
@@ -52,7 +53,8 @@ describe('xsrf request filter', function () {
         });
 
         expect(resp.statusCode).to.be(200);
-        expect(resp.payload).to.be('ok');
+        if (method === 'HEAD') expect(resp.payload).to.be.empty();
+        else expect(resp.payload).to.be('ok');
       });
 
       it('failes on invalid tokens', async function () {
@@ -66,7 +68,8 @@ describe('xsrf request filter', function () {
 
         expect(resp.statusCode).to.be(400);
         expect(resp.headers).to.have.property(xsrfHeader, version);
-        expect(resp.payload).to.match(/"Browser client is out of date/);
+        if (method === 'HEAD') expect(resp.payload).to.be.empty();
+        else expect(resp.payload).to.match(/"Browser client is out of date/);
       });
     });
   }

src/server/http/xsrf.js

@@ -6,7 +6,7 @@ export default function (kbnServer, server, config) {
   const header = 'kbn-version';
 
   server.ext('onPostAuth', function (req, reply) {
-    const noHeaderGet = req.method === 'get' && !req.headers[header];
+    const noHeaderGet = (req.method === 'get' || req.method === 'head') && !req.headers[header];
     if (disabled || noHeaderGet) return reply.continue();
 
     const submission = req.headers[header];