Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Harden security response headers for serverless offering #158000

Merged
merged 2 commits into from
May 18, 2023
Merged

Harden security response headers for serverless offering #158000

merged 2 commits into from
May 18, 2023

Conversation

jeramysoucy
Copy link
Contributor

@jeramysoucy jeramysoucy commented May 17, 2023 •
edited
Loading

Closes #150884

Summary

Adds both strictTransportSecurity and disableEmbedding to the serverless.yml config file, which sets the defaults for Kibana running in a serverless configuration. Note that the disabling of embedding is for the serverless MVP, with a plan to more strategically and explicitly allow embedding of specific resources in future releases.

  • server.securityResponseHeaders.strictTransportSecurity: max-age=31536000; includeSubDomains: Adds the strict-transport-security response header. The browser should remember that a site, including subdomains, is only to be accessed using HTTPS for 1 year.
  • server.securityResponseHeaders.disableEmbedding: true adds the X-Frame-Options response header with a avalue of SAMEORIGIN and adds frame-ancestors 'self' to the content-security-policy response header.

Note: if you are running without TLS enabled locally, you can disable the strict-transport-security response header by overriding the setting in kibana.dev.yml (see Testing step 8 below).

Testing (locally)

  1. Start Elasticearch
  2. Start Kibana with yarn start --serverless
  3. Sign into Kibana and open your browser's dev tools
  4. In the network tab, inspect one of the requests for localhost
  5. In the Headers tab, verify the above defined headers and values are present
  6. Stop Kibana, and restart normally with yarn start
  7. Repeat the process in steps 4-6 and verify that the above defined headers and values are not present
  8. Stop Kibana, edit the Kibana.dev.yml file by adding server.securityResponseHeaders.strictTransportSecurity: null
  9. Start Kibana with yarn start --serverless
  10. Repeat the process in steps 4-6 and verify that the headers and values associated with disableEmbedding are present while the strict-transport-security response header is not present.

@jeramysoucy jeramysoucy added Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! release_note:skip Skip the PR/issue when compiling release notes backport:skip This commit does not require backporting v8.9.0 labels May 17, 2023
@jeramysoucy jeramysoucy self-assigned this May 17, 2023
@jeramysoucy jeramysoucy marked this pull request as ready for review May 17, 2023 16:05
@elasticmachine
Copy link
Contributor

Pinging @elastic/kibana-security (Team:Security)

@jeramysoucy jeramysoucy requested a review from a team May 17, 2023 16:05
@kibana-ci
Copy link
Collaborator

💚 Build Succeeded

Metrics [docs]

Unknown metric groups

ESLint disabled line counts

id before after diff
enterpriseSearch 19 21 +2
securitySolution 400 404 +4
total +6

Total ESLint disabled count

id before after diff
enterpriseSearch 20 22 +2
securitySolution 480 484 +4
total +6

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @jeramysoucy

thomheymann
thomheymann approved these changes May 18, 2023
View reviewed changes
Copy link
Contributor

@thomheymann thomheymann left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! All working as expected.

@jeramysoucy jeramysoucy merged commit ba00502 into elastic:main May 18, 2023
delanni pushed a commit to delanni/kibana that referenced this pull request May 25, 2023
@jeramysoucy @delanni
Harden security response headers for serverless offering (elastic#158000
0041a4c 
)

Closes elastic#150884

## Summary

Adds both strictTransportSecurity and disableEmbedding to the
serverless.yml config file, which sets the defaults for Kibana running
in a serverless configuration. Note that the disabling of embedding is
for the serverless MVP, with a plan to more strategically and explicitly
allow embedding of specific resources in future releases.

- `server.securityResponseHeaders.strictTransportSecurity:
max-age=31536000; includeSubDomains`: Adds the
`strict-transport-security` response header. The browser should remember
that a site, including subdomains, is only to be accessed using HTTPS
for 1 year.
- `server.securityResponseHeaders.disableEmbedding`: true adds the
`X-Frame-Options` response header with a avalue of `SAMEORIGIN` and adds
`frame-ancestors 'self'` to the `content-security-policy` response
header.

Note: if you are running without TLS enabled locally, you can disable
the `strict-transport-security` response header by overriding the
setting in kibana.dev.yml (see Testing step 8 below).

### Testing (locally)
1. Start Elasticearch
3. Start Kibana with `yarn start --serverless`
4. Sign into Kibana and open your browser's dev tools
5. In the network tab, inspect one of the requests for localhost
6. In the Headers tab, verify the above defined headers and values are
present
7. Stop Kibana, and restart normally with `yarn start`
8. Repeat the process in steps 4-6 and verify that the above defined
headers and values are not present
9. Stop Kibana, edit the Kibana.dev.yml file by adding
`server.securityResponseHeaders.strictTransportSecurity: null`
10. Start Kibana with `yarn start --serverless`
11. Repeat the process in steps 4-6 and verify that the headers and
values associated with disableEmbedding are present while the
`strict-transport-security` response header is not present.
@jeramysoucy jeramysoucy added the Feature:Hardening Harding of Kibana from a security perspective label May 25, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@thomheymann thomheymann thomheymann approved these changes

Assignees

@jeramysoucy jeramysoucy

Labels
backport:skip This commit does not require backporting Feature:Hardening Harding of Kibana from a security perspective release_note:skip Skip the PR/issue when compiling release notes Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! v8.9.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Harden security response headers for serverless offering
4 participants
@jeramysoucy @elasticmachine @kibana-ci @thomheymann