server.xsrf.whitelist changed to server.xsrf.allowlist

[Bernhard-Fluehmann]

Kibana version:
7.11

Steps to reproduce:

1. https://www.elastic.co/guide/en/kibana/7.10/settings.html#settings-xsrf-whitelist
2. https://www.elastic.co/guide/en/kibana/7.11/settings.html#settings-xsrf-allowlist

Expected behavior:
It seems that settings.xsrf.whitelist has changed to settings.sxrf.allowlist without any mention in release notes or breaking changes.
Please shed light to this. Are still both options working, or is it a breaking change? Please fix documentation as well, either add a deprecation note or breaking change.

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[elasticmachine]

Pinging @elastic/kibana-docs (Team:Docs)

[jbudz]

Both options should still be allowed. If using the older setting, you should see a deprecation warning in the logs. We should be able to add both settings back into the list, one with a deprecated label. Thanks for catching that.

Tested on 7.11.0 and 7.12.0:

  log   [14:23:17.378] [warning][config][deprecation] "server.xsrf.whitelist" is deprecated and has been replaced by "server.xsrf.allowlist"

Are you having issues starting Kibana?

[Bernhard-Fluehmann]

@jbudz Thank you for the fast response. Fortunately I have no issues so far since the stack is still on 7.9 (Thus I did not see the warnings yet). I ran into it while reviewing the docs, configs and logs to prepare for an update. Since still both options are valid it‘s ok.
But IMHO it would still be worth to add it to the doku as well.

[KOTungseth]

@jbudz I can add settings-xsrf-whitelist as a deprecation to the 7.11 release notes, but is it considered a breaking change? I have reservations because it was never picked up by the release notes script as a breaking change.

[Bernhard-Fluehmann]

IMO accordimg to the log message a deprication is correct.

[jbudz]

👍 Not considered a breaking change, yet. When we do remove the setting we'll want to note it.

[mshustov]

Not considered a breaking change, yet.

@KOTungseth server.xsrf.whitelist is deprecated, but not removed yet.
We even use it in tests https://github.com/elastic/kibana/blob/master/x-pack/test/case_api_integration/common/config.ts#L125

When we do remove the setting we'll want to note it.

Right. However, I agree that I should have used the release_note:deprecation label for #84791

I believe we can close the issue. Any objections?