Adding X-Frames-Options DENY header for Kibana (#3516)

Changes done to add X-Frames-Options DENY header for Kibana requests.
tigera · Sep 23, 2024 · 06fc604 · 06fc604
1 parent dcd1198
commit 06fc604
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/pkg/render/logstorage/kibana/kibana.go b/pkg/render/logstorage/kibana/kibana.go
@@ -215,6 +215,9 @@ func (k *kibana) kibanaCR() *kbv1.Kibana {
 		"basePath":        fmt.Sprintf("/%s", BasePath),
 		"rewriteBasePath": true,
 		"defaultRoute":    fmt.Sprintf(DefaultRoute, TimeFilter, url.PathEscape(FlowsDashboardName)),
+		"customResponseHeaders": map[string]interface{}{
+			"X-Frame-Options": "DENY",
+		},
 	}
 
 	if k.cfg.BaseURL != "" {

diff --git a/pkg/render/logstorage/kibana/kibana_test.go b/pkg/render/logstorage/kibana/kibana_test.go
@@ -169,6 +169,17 @@ var _ = Describe("Kibana rendering tests", func() {
 			Expect(x["publicBaseUrl"]).To(Equal("https://test.domain.com/tigera-kibana"))
 		})
 
+		It("should configure X-Frame-Options as DENY in customResponseHeaders", func() {
+			component := kibana.Kibana(cfg)
+
+			createResources, _ := component.Objects()
+			kb := rtest.GetResource(createResources, kibana.CRName, kibana.Namespace, "kibana.k8s.elastic.co", "v1", "Kibana")
+			kibana := kb.(*kbv1.Kibana)
+			server := kibana.Spec.Config.Data["server"].(map[string]interface{})
+			customResponseHeaders := server["customResponseHeaders"].(map[string]interface{})
+			Expect(customResponseHeaders["X-Frame-Options"]).To(Equal("DENY"))
+		})
+
 		It("should delete Kibana ExternalService", func() {
 			cfg.KbService = &corev1.Service{
 				ObjectMeta: metav1.ObjectMeta{Name: kibana.ServiceName, Namespace: kibana.Namespace},