Kibana server should not rendering directory listings

[epixa]

The Kibana server should not render directory listings:

If someone really wants to expose a directory for the sake of sharing its contents, they should do so via their reverse proxy.

[vicvega]

@spalger, why did you make this setting configurable?
I mean why someone should need to enable directory listing? I can't see any reason

[epixa]

I also can't imagine why someone would need this, but like it or not, the feature does exist at the moment. If we remove it outright, then we might be removing a feature that someone has come to rely on.

[spalger]

The reason I like directory listings is because it lets you figure out what files are available when you don't have access to the file system for whatever reason. This might sound like a security issue, and if you don't want people to know what assets are available you would be "right", but I think there are perfectly valid reasons to expose this information and totally non-malicious reasons you would want this information.

By turning it on only in dev people can use it while writing plugins but... I'm open to disabling it completely.

I think there is a good reason this is generally a default behavior of static file servers though.

[vicvega]

We are using a ES cluster secured by shield to protect sensitive data and that /bundles/ directory is exposed without any authentication.
I know those are just public static assets, and it is not a real security issue, but it smells like it...

I'd suggest to let it configurable, but at least disabled by default

[spalger]

Cool, it is configurable and disabled by default in "production" mode, the default mode. If you set the kibana environment to "development" then this will turn on too, but there's no reason for users to do that.