New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Security: Disable JSONP by default #6795
Conversation
By default, disable the option to use JSONP in our REST layer closes elastic#6795
@@ -140,7 +140,7 @@ public RestFilterChain filterChain(RestFilter executionFilter) { | |||
|
|||
public void dispatchRequest(final RestRequest request, final RestChannel channel) { | |||
// If JSONP is disabled and someone sends a callback parameter we should bail out before querying | |||
if (!settings.getAsBoolean("http.jsonp.enable", true) && request.hasParam("callback")){ | |||
if (!settings.getAsBoolean("http.jsonp.enable", false) && request.hasParam("callback")){ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can the "http.jsonp.enable"
setting be moved to a constant?
LGTM, left a minor comment. |
Actually, |
@dakrone pushed fixes to relevant comments |
LGTM, +1 |
@@ -241,17 +241,19 @@ document indexed. | |||
[float] | |||
=== JSONP | |||
|
|||
By default JSONP resposes are enabled. All REST APIs accept a `callback` parameter | |||
resulting in a http://en.wikipedia.org/wiki/JSONP[JSONP] result. You can disable |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we should put a note that this was changed in 1.3
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
aye!, will fix
@s1monw fixed doc |
LGTM |
By default, disable the option to use JSONP in our REST layer closes #6795
By default, disable the option to use JSONP in our REST layer