Skip to main content

Elasticsearch CORS with basic authentication setup

This is a short "recipe" article explaining how to configure remote ElasticSearch instance to support CORS requests and basic authentication using Apache HTTP Server 2.4.

Proxy
To start with, we need to configure Apache to proxy requests to the Elasticsearch instance. By default, Elasticsearch is running on the port 9200: 
ProxyPass /elastic http://localhost:9200/
ProxyPassReverse /elastic http://localhost:9200/

Basic authentication
Enabling basic authentication is easy. By default, Apache checks the user credentials against the local file which you can create using the following command: 
/path/to/htpasswd -c /usr/local/apache/password/.htpasswd_elasticsearch elasticsearchuser
Then you'll need to use the following directives to allow only authenticated users to access your content: 
AuthType Basic
AuthName "Elastic Server"
AuthUserFile /usr/local/apache/password/.htpasswd_elasticsearch
Require valid-user
For more complex setups such as LDAP-based authentication and restricting access by user group or other criterias, see official howto.

CORS
When you want to add support of CORS requests to your server, you should configure it to set proper response headers starting with Access-Control-Allow-Origin. To make it work with basic authentication, you will need the following headers: 
Header set Access-Control-Allow-Origin "*"
Header set Access-Control-Allow-Credentials: "*"
Header set Access-Control-Allow-Headers: "Authorization, Content-Type, X-Requested-With"
If you need to support HTTP PUT requests or want to see more detailed explanations with examples, check Using CORS tutorial.
The above configuration is still not enough to make basic authentication work as the HTTP OPTIONS pre-flight request is sent without Authorization header. So we need to allow such requests non password-protected:
<LimitExcept OPTIONS>
 Require valid-user
</LimitExcept>

Final configuration
Let's move the complete configuration inside a Location directive now: 
<Location /elastic>
 ProxyPass http://localhost:9200/
 ProxyPassReverse http://localhost:9200/

 Header set Access-Control-Allow-Origin "*"
 Header set Access-Control-Allow-Credentials: "*"
 Header set Access-Control-Allow-Headers: "Authorization, Content-Type, X-Requested-With"

 AuthType Basic
 AuthName "Elastic Server PROD"
 AuthUserFile /usr/local/apache/password/.htpasswd_elasticsearch

 <LimitExcept OPTIONS>
  Require valid-user
 </LimitExcept>
</Location>
Labels:

Comments

Post a Comment

Popular posts from this blog

Choosing Java reporting tool - part 2

I've provided a general overview of possible solutions to get a reporting/exporting functionality in the previous post . This is the second overview of alternatives based on JasperReports reporting engine. Since the previous part I've done the following: Implemented a simple report using both DynamicJasper and DynamicReports to compare them from technical side. Investigated JasperServer features and tried to implement a simple report for JasperServer instance (it appeared we already have a ready licensed installation of JasperServer that makes it unreasonable to install a fresh one). First, the comparison results of Java libraries (DynamicJasper and DynamicReports): Both libraries suffer from poor-quality or missing Java docs but they look a bit better in DynamicJasper. Taking into account the point 1, a developer has to use online documentation and to review the code. Here the code looks definitely nicer and more readable for DynamicRepo...
4 comments
Read more

Managing Content Security Policy (CSP) in IBM MAS Manage

This article explores a new system property introduced in IBM MAS 8.11.0 and Manage 8.7.0+ that enhances security but can inadvertently break Google Maps functionality within Manage. We'll delve into the root cause, provide a step-by-step solution, and offer best practices for managing Content Security Policy (CSP) effectively. Understanding the issue IBM MAS 8.11.0 and Manage 8.7.0 introduced the mxe.sec.header.Content_Security_Policy   property, implementing CSP to safeguard against injection attacks. While beneficial, its default configuration restricts external resources, causing Google Maps and fonts to malfunction. CSP dictates which domains can serve various content types (scripts, images, fonts) to a web page. The default value in this property blocks Google-related domains by default. Original value font-src 'self' data: https://1.www.s81c.com *.walkme.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' ...
Post a Comment
Read more

DynamicReports and Spring MVC integration

This is a tutorial on how to exploit DynamicReports reporting library in an existing  Spring MVC based web application. It's a continuation to the previous post where DynamicReports has been chosen as the most appropriate solution to implement an export feature in a web application (for my specific use case). The complete code won't be provided here but only the essential code snippets together with usage remarks. Also I've widely used this tutorial that describes a similar problem for an alternative reporting library. So let's turn to the implementation description and start with a short plan of this how-to: Adding project dependencies. Implementing the Controller part of the MVC pattern. Modifying the View part of the MVC pattern. Modifying web.xml. Adding project dependencies I used to apply Maven Project Builder throughout my Java applications, thus the dependencies will be provided in the Maven format. Maven project pom.xml file: net.sourcefo...
9 comments
Read more