Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[X-Pack] Login after session timeout does not direct user back to previously viewed page with reverse proxy #19600

Closed
inqueue opened this issue May 31, 2018 · 2 comments
Labels
Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!

Comments

@inqueue
Copy link
Member

inqueue commented May 31, 2018

Kibana version:
5.6.9 w/X-Pack Security enabled
Kibana is behind a reverse proxy.

Elasticsearch version:
5.6.9

Browser version:
Version 66.0.3359.181 (Official Build) (64-bit)

Describe the bug:
Login after session timeout does not direct the browser back to the page where the timeout was reached when Kibana is behind a reverse proxy.

Steps to reproduce:

  1. Put Kibana behind a reverse proxy and configure server.basePath: "/kibana" in kibana.yml. Configure reverse proxy accordingly.
  2. Configure xpack.security.sessionTimeout: 10000 in kibana.yml (sets the session timeout to 10s)
  3. Login to Kibana, goto Dev Tools and wait 10 seconds.
  4. After the session expires, login with credentials used in step 3.
  5. Observe the browser lands on the default app after login and not Dev Tools.

Expected behavior:
Browser is directed back to Dev Tools.

Screenshots (if relevant):
session_timeout

Errors in browser console (if relevant):
none

Any additional context:
Does not reproduce in the default configuration without reverse proxy; i.e., server.basePath unset. Issue reproduces with or without SSL enabled at the reverse proxy.

nginx config:

server {
  listen       6601;
  listen       4601 ssl;
  server_name  localhost;
  ssl_certificate      localhost.pem;
  ssl_certificate_key  localhost.key;
  ssl_session_cache    shared:SSL:1m;
  ssl_session_timeout  5m;
  ssl_ciphers  HIGH:!aNULL:!MD5;
  ssl_prefer_server_ciphers  on;

  location /kibana {
    proxy_pass  http://localhost:5601/;
    rewrite ^/kibana/(.*)$ /$1 break;
  }
}

kibana.yml:

xpack.security.sessionTimeout: 10000
server.basePath: "/kibana"
@legrego legrego added the Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more! label May 31, 2018
@chandlermelton
Copy link

This configuration was working as intended in version 5.1.2.

@inqueue inqueue changed the title [X-Pack] Login after session timeout does not direct user back to previously view page with reverse proxy [X-Pack] Login after session timeout does not direct user back to previously viewed page with reverse proxy May 31, 2018
@kobelb
Copy link
Contributor

kobelb commented Jan 14, 2019

Duplicate of #22440

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Security Team focused on: Auth, Users, Roles, Spaces, Audit Logging, and more!
Projects
None yet
Development

No branches or pull requests

7 participants