Migrate `/bootstrap.js` endpoint to core #92784

pgayvallet · 2021-02-25T11:20:11Z

Summary

Fix #54375

This PR migrates the /bootstrap.js and /app/{id}/{any*} endpoints from legacy to core.

Add the authRequired: 'try' mode for routes (required for the bootstrap.js logic)
~~Add the http.auth.isEnabled API (required for the bootstrap.js logic)~~
~~Add the HttpResponseOptions.etag API (required for the bootstrap.js logic)~~
Migrate the /bootstrap.js endpoint to core
Migrate the /app/{id}/{any*} endpoint to core
Add RUM config to all httpResources routes
Get rid of the legacy uiRender mixin

Checklist

Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios

legrego · 2021-02-25T16:51:58Z

src/core/server/rendering/bootstrap/register_bootstrap_route.ts

+    {
+      path: '/bootstrap.js',
+      options: {
+        authRequired: 'optional',


@azasypkin,

This PR moves the /bootstrap.js endpoint out of legacy and into core -- as part of this change, the route went from hapi's authMode of try to optional.

This caused a lot of x-pack test failures, because some test suites ended up loading Kibana with an incorrect Authorization header (invalid credentials). In the legacy world where this used try, the invalid credentials allowed the /bootstrap.js request to succeed. Now that this route is using authMode: 'optional', the request fails when presented with invalid credentials.

We previously asked the core team to implement authMode: 'optional' for the KP, because we needed to detect if the user had a valid session or not, without directly relying on the existence of the session cookie (#58589). Now that we have server-side sessions, it's not clear to me if we need to keep these routes as optional, or if we can move them to try.

My gut feeling is that we don't need the behavior that optional gives us anymore, but I wanted to double check with you, since you're well-versed on the different auth flows and states.

FWIW I went with adding the try auth mode for now.

Sorry for the delayed reply, just caught up on the emails after PTO.

This caused a lot of x-pack test failures, because some test suites ended up loading Kibana with an incorrect Authorization header (invalid credentials).

Interesting, why do we do that? Is there any legitimate case when it makes sense?

We previously asked the core team to implement authMode: 'optional' for the KP, because we needed to detect if the user had a valid session or not, without directly relying on the existence of the session cookie (#58589).

Right, we wanted to abstract away from the fact that session is stored in the cookie running the Core authentication hook instead. But the hook shouldn't fail, or redirect to IdP (for SAML/OIDC), or automatically initiate new session (PKI/Kerberos) if credentials aren't provided.

Now that we have server-side sessions, it's not clear to me if we need to keep these routes as optional, or if we can move them to try.

I'm not sure how server-side sessions would change anything here to be honest, can you please elaborate a bit?

At that time we picked optional as seemingly the safest option (if you send any credentials you likely expect them to be respected) and the one with the behavior similar to the ES behavior when anonymous access is enabled there (requests without credentials are treated as anonymous and requests with invalid credentials are rejected). I still feel that try behavior is a bit confusing (any request credentials are attempted authentication, but if the credentials are invalid, the request proceeds regardless of the authentication error).

Having said that I believe we can safely switch our routes (login, logged_out etc.) to try since our authentication pipeline only cares if authentication is strictly required or not. So we won't need optional anymore.

…-bootstrap-endpoint

pgayvallet

self review

pgayvallet · 2021-03-01T10:32:08Z

src/core/server/core_app/core_app.ts

+    resources.register(
+      {
+        path: '/app/{id}/{any*}',
+        validate: false,
+        options: {
+          authRequired: true,
+        },
+      },
+      async (context, request, response) => {
+        return response.renderCoreApp();
+      }
+    );


/app/{id} is registered from the CoreApp service

We are using renderCoreApp which ensure consistency between the 'default route' apps and the manually registered app endpoints.

pgayvallet · 2021-03-01T10:33:53Z

src/core/server/http/http_server.ts

+    if (authRequired === 'try') {
+      return { mode: 'try' };
+    }


See #92784 (comment) for more context about the addition of the try auth mode.

@elastic/kibana-security tell me if you'd prefer that I replace the behavior of the optional mode instead (but imho having both makes sense)

I'm happy with the approach you have here. I don't see why we can't support both try and optional

pgayvallet · 2021-03-01T10:35:47Z

src/core/server/http/integration_tests/http_auth.test.ts

+    describe('when authRequired is `true`', () => {
+      it('allows authenticated access when auth returns `authenticated`', async () => {
+        const { http } = await root.setup();
+        const { registerAuth, createRouter, auth } = http;
+
+        registerAuth((req, res, toolkit) => toolkit.authenticated());
+
+        const router = createRouter('');
+        registerRoute(router, auth, true);
+
+        await root.start();


Those can look similar to the auth tests we have in core_services.test.ts, but these added IT are testing the behavior of the interaction between the registered auth provider's response and the endpoint response directly (and more in depth)

src/core/server/http/router/response.ts

src/core/server/http_resources/get_apm_config.ts

pgayvallet · 2021-03-01T11:12:22Z

src/core/server/rendering/bootstrap/bootstrap.js.template.hbs

-      load([
-        {{#each styleSheetPaths}}
-          '{{this}}',
-        {{/each}}
-      ]);


Stylesheets are now directly included in the document generated by RenderingServiceSetup.render instead.

pgayvallet · 2021-03-01T11:23:00Z

src/core/server/rendering/bootstrap/bootstrap_renderer.ts

+  const isAuthenticated = (request: KibanaRequest) => {
+    if (!auth.isEnabled()) {
+      return true;
+    }
+    const { status: authStatus } = auth.get(request);
+    // status is 'unknown' when auth is disabled. we just need to not be `unauthenticated` here.
+    return authStatus !== 'unauthenticated';
+  };


This isAuthenticated function could be renamed amIAuthorizedToQueryElasticsearch, as it returns true either when auth is disabled (no security), or if auth is enabled AND the user is authenticated.

(Long) note: now that we moved the stylesheet loading to RenderingServiceSetup.render, the only remaining reason to load uiSettings stored in ES when rendering bootstrap.js is to compute the __kbnThemeTag__ (themeTag below) variable (that is used as a prefix by our client-side loader for stylesheets). I tried to move that variable initialization to the rendered document instead, however, because of our CSP policy, we can't use inline scripts (and injecting the variable from the client-side core code is too late)

An improvement would be to (re-)add a nonce-XXX option to our CSP, to let the rendering service have inlined scripts, but doing that properly (aka not as it was done in legacy before we removed it) would require to generate the nonce value per-request and to have the rendering service access this value when rendering the document. If technically doable, it is not trivial and require some thinking, so imho (given that we really want that) it should be done as a follow-up (we would even be able to inline the whole bootstrap.js script in the rendered document in that case).

cc @legrego @joshdover this is the reason why I was speaking about reintroducing nonce-

Mind creating a follow-up issue?

Created #93785

src/core/server/rendering/bootstrap/bootstrap_renderer.ts

pgayvallet · 2021-03-01T11:32:03Z

src/core/server/rendering/rendering_service.tsx

+        const darkMode = getSettingValue('theme:darkMode', settings, Boolean);
+        const themeVersion = getSettingValue('theme:version', settings, String);
+
+        const stylesheetPaths = getStylesheetPaths({
+          darkMode,
+          themeVersion,
+          basePath: serverBasePath,
+          buildNum,
+        });


Moving the stylesheets loading from bootstrap.js to the core/app document introduced a slight behavior change:

In bootstrap.js, we were checking if we were allowed to query ES to retrieve the user settings (security off OR security ON + user authenticated)

In the rendering service, we depends on the includeUserSettings input parameter, which is always false for unauthenticated routes (such as login)

In short: previously, an authenticated user accessing the login page would be able to use the persisted user settings, and now, the default setting values will always be used. As we are reloading the app when logging in, I think this is okay.

If not, we will have to re-use the isAuthenticated method/logic from rendering/bootstrap/bootstrap_renderer.ts instead of this includeUserSettings parameter (which could then be totally removed from the render API)

No strong opinion on that one, tell me what you think.

pgayvallet · 2021-03-01T11:33:09Z

src/legacy/server/kbn_server.js

@@ -72,8 +71,6 @@ export default class KbnServer {
        // tell the config we are done loading plugins
        configCompleteMixin,

-        uiMixin,


…-bootstrap-endpoint

mshustov · 2021-03-09T16:48:47Z

src/core/server/rendering/bootstrap/bootstrap_renderer.ts

+
+    // These paths should align with the bundle routes configured in
+    // src/optimize/bundles_route/bundles_route.ts
+    const publicPathMap = JSON.stringify({


I'm surprised src/optimize/bundles_route/bundles_route.ts doesn't have a similar comment.

My next step is to migrate the bundle_route anyway, will add the comment when moving the route to core.

mshustov · 2021-03-09T16:51:57Z

src/core/server/rendering/bootstrap/bootstrap_renderer.ts

+  etag: string;
+}
+
+export const bootstrapRendererFactory: BootstrapRendererFactory = ({


optional: this file contains some logic, but I don't see bootstrapRendererFactory is tested

mshustov · 2021-03-09T17:09:22Z

src/core/server/rendering/bootstrap/bootstrap_renderer.ts

+    let darkMode = false;
+    let themeVersion = 'v7';
+
+    try {
+      const authenticated = isAuthenticated(request);
+      darkMode = authenticated ? await uiSettingsClient.get('theme:darkMode') : false;
+      themeVersion = authenticated ? await uiSettingsClient.get('theme:version') : 'v7';
+    } catch (e) {
+      // just use the default values in case of connectivity issues with ES
+    }
+
+    const themeTag = `${themeVersion === 'v7' ? 'v7' : 'v8'}${darkMode ? 'dark' : 'light'}`;


optional: we can keep it as is, but I'd extract themeTag calculation to a separate function to simplify reading.
Also, it's not obvious without a comment how __kbnThemeTag__ is used.

…-bootstrap-endpoint

kibanamachine · 2021-03-10T09:24:10Z

💚 Build Succeeded

Metrics [docs]

✅ unchanged

History

💚 Build #111675 succeeded 2cf36bc
💔 Build #111656 failed c652901
💔 Build #111633 failed b9dc60c
💔 Build #111480 failed 8232f68
💔 Build #111396 failed 129cdea

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* move bootstrap endpoint to core * some initial cleanup * hack around the 'try' auth status * some UT * more UT * add try/catch around uISettings access * add 'auth.isEnabled' * remove dead files * use `try` authent mode * adapt UT * revert themeTag movearound * migrate apps route to core * some cleanup * nit * add integration tests * update generated doc * add UT for /app route * add etag IT * nits * remove auth.isEnabled API * add tests on get_apm_config * use string template instead of handlebars for bootstrap template * improve plugin bundle tests * update generated doc * remove response.etag API * update generated doc * update generated doc * update generated doc again * extract getThemeTag * add more unit tests

pgayvallet added 7 commits February 25, 2021 12:18

move bootstrap endpoint to core

b98beae

some initial cleanup

16d851a

hack around the 'try' auth status

767cc1b

some UT

687935a

more UT

811ce5d

add try/catch around uISettings access

6754b96

add 'auth.isEnabled'

cd32213

pgayvallet force-pushed the kbn-54375-migrate-bootstrap-endpoint branch from 9ab1025 to cd32213 Compare February 25, 2021 14:05

remove dead files

1ac65e8

legrego reviewed Feb 25, 2021

View reviewed changes

pgayvallet added 9 commits February 25, 2021 19:32

use try authent mode

176f016

adapt UT

539aa68

revert themeTag movearound

e3f63f6

migrate apps route to core

5f2df5f

Merge remote-tracking branch 'upstream/master' into kbn-54375-migrate…

314d7bd

…-bootstrap-endpoint

some cleanup

2215565

nit

d7634ea

add integration tests

8ca2c6d

update generated doc

960fa14

pgayvallet added chore Feature:Legacy Removal Issues related to removing legacy Kibana release_note:skip Skip the PR/issue when compiling release notes v7.13.0 labels Mar 1, 2021

pgayvallet added 2 commits March 1, 2021 11:30

add UT for /app route

7c8c7a1

add etag IT

6a9845a

pgayvallet commented Mar 1, 2021

View reviewed changes

pgayvallet added this to Pending Review in kibana-core [DEPRECATED] via automation Mar 1, 2021

pgayvallet marked this pull request as ready for review March 1, 2021 12:59

pgayvallet requested a review from a team as a code owner March 1, 2021 12:59

pgayvallet requested a review from mshustov March 1, 2021 12:59

pgayvallet added 7 commits March 5, 2021 11:02

remove auth.isEnabled API

8e62075

add tests on get_apm_config

9360ffa

use string template instead of handlebars for bootstrap template

e7dbf10

improve plugin bundle tests

8692e1d

update generated doc

f0a2e72

remove response.etag API

be2bb9d

update generated doc

129cdea

This was referenced Mar 5, 2021

Add nonce- to our CSP policy to allow inlining bootstrap.js inside the application document #93785

Open

Move /src/apm.js to its own package #93823

Closed

pgayvallet added 2 commits March 5, 2021 20:29

Merge remote-tracking branch 'upstream/master' into kbn-54375-migrate…

8232f68

…-bootstrap-endpoint

Merge remote-tracking branch 'upstream/master' into kbn-54375-migrate…

b9dc60c

…-bootstrap-endpoint

pgayvallet requested a review from mshustov March 8, 2021 07:45

pgayvallet added 2 commits March 8, 2021 11:18

update generated doc

c652901

update generated doc again

2cf36bc

mshustov reviewed Mar 9, 2021

View reviewed changes

mshustov approved these changes Mar 9, 2021

View reviewed changes

pgayvallet added 4 commits March 9, 2021 20:56

Merge remote-tracking branch 'upstream/master' into kbn-54375-migrate…

8c156f7

…-bootstrap-endpoint

extract getThemeTag

5e8fe9e

add more unit tests

793ce95

Merge remote-tracking branch 'upstream/master' into kbn-54375-migrate…

e117889

…-bootstrap-endpoint

pgayvallet merged commit d094912 into elastic:master Mar 10, 2021

kibana-core [DEPRECATED] automation moved this from Pending Review to Done (7.13) Mar 10, 2021

pgayvallet mentioned this pull request Mar 10, 2021

[7.x] Migrate /bootstrap.js endpoint to core (#92784) #94271

Merged

pgayvallet mentioned this pull request Mar 10, 2021

remove try auth mode #94287

Merged

2 tasks

TinaHeiligers mentioned this pull request Dec 1, 2021

Gracefully handle deprecated core API's #119866

Closed

6 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Migrate `/bootstrap.js` endpoint to core #92784

Migrate `/bootstrap.js` endpoint to core #92784

pgayvallet commented Feb 25, 2021 •

edited

Loading

legrego Feb 25, 2021

pgayvallet Mar 1, 2021 •

edited

Loading

azasypkin Mar 10, 2021

pgayvallet left a comment

pgayvallet Mar 1, 2021

pgayvallet Mar 1, 2021

legrego Mar 1, 2021

pgayvallet Mar 1, 2021

pgayvallet Mar 1, 2021

pgayvallet Mar 1, 2021

mshustov Mar 2, 2021

pgayvallet Mar 5, 2021

pgayvallet Mar 1, 2021

pgayvallet Mar 1, 2021

mshustov Mar 9, 2021

pgayvallet Mar 9, 2021

mshustov Mar 9, 2021

mshustov Mar 9, 2021

kibanamachine commented Mar 10, 2021

Migrate /bootstrap.js endpoint to core #92784

Migrate /bootstrap.js endpoint to core #92784

Conversation

pgayvallet commented Feb 25, 2021 • edited Loading

Summary

Checklist

Choose a reason for hiding this comment

pgayvallet Mar 1, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pgayvallet left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kibanamachine commented Mar 10, 2021

💚 Build Succeeded

Metrics [docs]

History

Migrate `/bootstrap.js` endpoint to core #92784

Migrate `/bootstrap.js` endpoint to core #92784

pgayvallet commented Feb 25, 2021 •

edited

Loading

pgayvallet Mar 1, 2021 •

edited

Loading