From c0ef3f7b231de0f1eb9a1af8635ec1d32c1f43f6 Mon Sep 17 00:00:00 2001
From: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
Date: Wed, 30 Oct 2024 12:26:49 +1100
Subject: [PATCH] [8.15] [8.15] [Kibana data view] Fix issue empty user-hash in
 data view request headers (#197863) (#198234)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Backport

This will backport the following commits from `main` to `8.15`:
- [[8.15] [Kibana data view] Fix issue empty user-hash in data view
request headers
(#197863)](https://github.com/elastic/kibana/pull/197863)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Mohamed
Abdelgaber","email":"muhamedabdelgaber@gmail.com"},"sourceCommit":{"committedDate":"2024-10-29T23:53:09Z","message":"[8.15]
[Kibana data view] Fix issue empty user-hash in data view request
headers (#197863)\n\nto fix not compliant HTTP request\r\n\r\n##
Summary\r\n\r\nFix not compliant HTTP request\r\nfor example, request
\"GET\r\n/s/<space>/internal/data_views/fields?pattern=abc\" Sometimes
request\r\nheaders have a user-hash field with an empty value and this
makes the\r\nrequest not HTTP compliant in some scenarios the request
will be dropped\r\nby WAF or by another security edge for
example.\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/de606665-12e6-475c-a2e4-c2e594957f11)\r\n\r\n---------\r\n\r\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>\r\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>\r\nCo-authored-by:
mabdelgaber.SEC
<mohamed.abdelgaber@orange.com>","sha":"f102ace317700a1841ec77c84c77f76041157746","branchLabelMapping":{"^v9.0.0$":"main","^v8.17.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","💝community","v9.0.0","Team:DataDiscovery","backport:prev-major"],"title":"[8.15]
[Kibana data view] Fix issue empty user-hash in data view request
headers","number":197863,"url":"https://github.com/elastic/kibana/pull/197863","mergeCommit":{"message":"[8.15]
[Kibana data view] Fix issue empty user-hash in data view request
headers (#197863)\n\nto fix not compliant HTTP request\r\n\r\n##
Summary\r\n\r\nFix not compliant HTTP request\r\nfor example, request
\"GET\r\n/s/<space>/internal/data_views/fields?pattern=abc\" Sometimes
request\r\nheaders have a user-hash field with an empty value and this
makes the\r\nrequest not HTTP compliant in some scenarios the request
will be dropped\r\nby WAF or by another security edge for
example.\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/de606665-12e6-475c-a2e4-c2e594957f11)\r\n\r\n---------\r\n\r\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>\r\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>\r\nCo-authored-by:
mabdelgaber.SEC
<mohamed.abdelgaber@orange.com>","sha":"f102ace317700a1841ec77c84c77f76041157746"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/197863","number":197863,"mergeCommit":{"message":"[8.15]
[Kibana data view] Fix issue empty user-hash in data view request
headers (#197863)\n\nto fix not compliant HTTP request\r\n\r\n##
Summary\r\n\r\nFix not compliant HTTP request\r\nfor example, request
\"GET\r\n/s/<space>/internal/data_views/fields?pattern=abc\" Sometimes
request\r\nheaders have a user-hash field with an empty value and this
makes the\r\nrequest not HTTP compliant in some scenarios the request
will be dropped\r\nby WAF or by another security edge for
example.\r\n\r\n\r\n![image](https://github.com/user-attachments/assets/de606665-12e6-475c-a2e4-c2e594957f11)\r\n\r\n---------\r\n\r\nCo-authored-by:
kibanamachine
<42973632+kibanamachine@users.noreply.github.com>\r\nCo-authored-by:
Elastic Machine
<elasticmachine@users.noreply.github.com>\r\nCo-authored-by:
mabdelgaber.SEC
<mohamed.abdelgaber@orange.com>","sha":"f102ace317700a1841ec77c84c77f76041157746"}}]}]
BACKPORT-->

Co-authored-by: Mohamed Abdelgaber <muhamedabdelgaber@gmail.com>
---
 .../data_views/public/data_views/data_views_api_client.test.ts | 3 ---
 .../data_views/public/data_views/data_views_api_client.ts      | 3 ++-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/plugins/data_views/public/data_views/data_views_api_client.test.ts b/src/plugins/data_views/public/data_views/data_views_api_client.test.ts
index 66f025dc07835..73a8cb34c1803 100644
--- a/src/plugins/data_views/public/data_views/data_views_api_client.test.ts
+++ b/src/plugins/data_views/public/data_views/data_views_api_client.test.ts
@@ -28,9 +28,6 @@ describe('IndexPatternsApiClient', () => {
     expect(fetchSpy).toHaveBeenCalledWith(expectedPath, {
       // not sure what asResponse is but the rest of the results are useful
       asResponse: true,
-      headers: {
-        'user-hash': '',
-      },
       query: {
         allow_hidden: undefined,
         allow_no_index: undefined,
diff --git a/src/plugins/data_views/public/data_views/data_views_api_client.ts b/src/plugins/data_views/public/data_views/data_views_api_client.ts
index 404db1028fd3f..f7b9ebc1090f6 100644
--- a/src/plugins/data_views/public/data_views/data_views_api_client.ts
+++ b/src/plugins/data_views/public/data_views/data_views_api_client.ts
@@ -55,6 +55,7 @@ export class DataViewsApiClient implements IDataViewsApiClient {
     const userId = await this.getCurrentUserId();
 
     const userHash = userId ? await sha1(userId) : '';
+    const headers = userHash ? { 'user-hash': userHash } : undefined;
 
     const request = body
       ? this.http.post<T>(url, { query, body, version, asResponse })
@@ -63,7 +64,7 @@ export class DataViewsApiClient implements IDataViewsApiClient {
           version,
           ...cacheOptions,
           asResponse,
-          headers: { 'user-hash': userHash },
+          headers,
         });
 
     return request.catch((resp) => {