[Breaking] Restrict internal APIs by default in 9.0 #163654
Assignees
Labels
Breaking Change
Feature:http
Team:Core
Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc
v9.0.0
Comments
lukeelmers
added
Feature:http
Team:Core
|
Pinging @elastic/kibana-core (Team:Core) |
it might happen sooner than we thought! |
|
Part of #179467 |
20 tasks
45 tasks
This was referenced Aug 27, 2024
|
For PR review: Add how to enable the restriction for testing. |
1 task
TinaHeiligers
added a commit
that referenced
this issue
Sep 12, 2024
fix #192052 ## Summary Internal APIs will be [restricted](#163654) from public access as of 9.0.0. In non-serverless environments, this breaking change will result in a 400 error if an external request is made to an internal Kibana API (route `access` option as `"internal"` or `"public"`). This PR allows API owners of non-xpack plugins to run their `ftr` API integration tests against the restriction and adds examples of how to handle it. ### Checklist - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios Note to reviewers: The header needed to allow access to internal apis shouldn't change your test output, with or without the restriction enabled. ### How to test the changes work: #### Non x-pack: 1. Set `server.restrictInternalApis: true` in `test/common/config.js` 2. Ensure your tests pass #### x-pack: 1. Set `server.restrictInternalApis: true` in `x-pack/test/api_integration/apis/security/config.ts` 2. Ensure the spaces tests pass --------- Co-authored-by: Elastic Machine <[email protected]>
4 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
For our serverless offering we introduced a mechanism to prevent access to internal-only APIs by setting
server.restrictInternalApis: true.We cannot enable this in on-prem / ESS Kibana in 8.x as it would be a breaking change, however we should remove this configuration in 9.0 so we can enforce internal API restrictions in all environments.
We also need to add a KB to communicate the change with Support.
Opening this issue as a reminder for whenever 9.0 rolls around.
The text was updated successfully, but these errors were encountered: