Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not allowing index names in request body for multi-get/search/bulk when indices are already given in url #3636

Closed
wuchanghua opened this Issue Sep 5, 2013 · 0 comments

Comments

Projects
None yet
2 participants
@wuchanghua
Copy link

wuchanghua commented Sep 5, 2013

Rational: Many users currently use URL-based access control to secure access to ES. For multi-search/get queries, currently the user can put the indices in the request body, which poses a challenge to the URL-based security approach.

This request is to add a feature for multi-search/get such that when index(or indices) is given in the URL, prohibiting the request body to contain the index (indices).

In this way, all request to ES can be secured via URL.

Add a flag, called rest.action.multi.allow_explicit_index that can be set in the settings/config (default to true). If set to false, will reject requests that have explicit index specified in their body.

@ghost ghost assigned kimchy Sep 5, 2013

@kimchy kimchy closed this in 3e92b1d Sep 5, 2013

kimchy added a commit that referenced this issue Sep 5, 2013

kimchy added a commit that referenced this issue Sep 5, 2013

mute pushed a commit to mute/elasticsearch that referenced this issue Jul 29, 2015

mute pushed a commit to mute/elasticsearch that referenced this issue Jul 29, 2015

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.