Getting access to custom headers in kibana client

Question

I'm trying to get value of custom header set in response of our server in kibana react client using axios but it seems that it's not accessiable even though it's showing in browser console (Access-Control-Expose-Headers is also set).

My question is that is there some sort of configuration in kibana that prevents custom headers from being accessiable to client or not.

Thanks.

Answer 1

Yes, there are some configuration in Elasticsearch that can prevent customer headers. It's called http.cors. Here is the values that you need to add elasticsearch.yml for that:

http.cors.enabled: true
http.cors.allow-credentials: true
http.cors.allow-origin: "*"
http.cors.allow-headers: "*"
http.cors.allow-methods: "OPTIONS,HEAD,GET,POST,PUT,DELETE"

Also, you can check the current settings with the following API call.

GET _cluster/settings?include_defaults&filter_path=**.cors

An example output:

{
  "defaults": {
    "http": {
      "cors": {
        "max-age": "1728000",
        "allow-origin": "*",
        "allow-headers": "*",
        "allow-credentials": "true",
        "allow-methods": "OPTIONS,HEAD,GET,POST,PUT,DELETE",
        "enabled": "true"
      }
    }
  }
}

For security reasons, it is recommended to incorporate appropriate restrictions.