Backport elastic#7696 to 4.x

lukasolson · Aug 5, 2016 · cea41cd · cea41cd
1 parent 3727e0a
commit cea41cd
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 5 deletions.
diff --git a/src/server/http/__tests__/xsrf.js b/src/server/http/__tests__/xsrf.js
@@ -5,7 +5,7 @@ import { resolve } from 'path';
 const requireFromTest = require('requirefrom')('test');
 const kbnTestServer = requireFromTest('utils/kbn_server');
 
-const nonDestructiveMethods = ['GET'];
+const nonDestructiveMethods = ['GET', 'HEAD'];
 const destructiveMethods = ['POST', 'PUT', 'DELETE'];
 const src = resolve.bind(null, __dirname, '../../../../src');
 
@@ -30,9 +30,10 @@ describe('xsrf request filter', function () {
 
     await kbnServer.ready();
 
+    const routeMethods = nonDestructiveMethods.filter(method => method !== 'HEAD').concat(destructiveMethods);
     kbnServer.server.route({
       path: '/xsrf/test/route',
-      method: [...nonDestructiveMethods, ...destructiveMethods],
+      method: routeMethods,
       handler: function (req, reply) {
         reply(null, 'ok');
       }
@@ -54,7 +55,8 @@ describe('xsrf request filter', function () {
         });
 
         expect(resp.statusCode).to.be(200);
-        expect(resp.payload).to.be('ok');
+        if (method === 'HEAD') expect(resp.payload).to.be.empty();
+        else expect(resp.payload).to.be('ok');
       });
 
       it('failes on invalid tokens', async function () {
@@ -68,7 +70,8 @@ describe('xsrf request filter', function () {
 
         expect(resp.statusCode).to.be(400);
         expect(resp.headers).to.have.property(xsrfHeader, version);
-        expect(resp.payload).to.match(/"Browser client is out of date/);
+        if (method === 'HEAD') expect(resp.payload).to.be.empty();
+        else expect(resp.payload).to.match(/"Browser client is out of date/);
       });
     });
   }

diff --git a/src/server/http/xsrf.js b/src/server/http/xsrf.js
@@ -6,7 +6,7 @@ export default function (kbnServer, server, config) {
   const header = 'kbn-version';
 
   server.ext('onPostAuth', function (req, reply) {
-    const noHeaderGet = req.method === 'get' && !req.headers[header];
+    const noHeaderGet = (req.method === 'get' || req.method === 'head') && !req.headers[header];
     if (disabled || noHeaderGet) return reply.continue();
 
     const submission = req.headers[header];