payload: {"action":"created","issue":{"url":"https://api.github.com/repos/elastic/kibana/issues/39477","repository_url":"https://api.github.com/repos/elastic/kibana","labels_url":"https://api.github.com/repos/elastic/kibana/issues/39477/labels{/name}","comments_url":"https://api.github.com/repos/elastic/kibana/issues/39477/comments","events_url":"https://api.github.com/repos/elastic/kibana/issues/39477/events","html_url":"https://github.com/elastic/kibana/pull/39477","id":459389982,"node_id":"MDExOlB1bGxSZXF1ZXN0MjkwNzYyMjMy","number":39477,"title":"NP Security HTTP Interceptors","user":{"login":"kobelb","id":627123,"node_id":"MDQ6VXNlcjYyNzEyMw==","avatar_url":"https://avatars0.githubusercontent.com/u/627123?v=4","gravatar_id":"","url":"https://api.github.com/users/kobelb","html_url":"https://github.com/kobelb","followers_url":"https://api.github.com/users/kobelb/followers","following_url":"https://api.github.com/users/kobelb/following{/other_user}","gists_url":"https://api.github.com/users/kobelb/gists{/gist_id}","starred_url":"https://api.github.com/users/kobelb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kobelb/subscriptions","organizations_url":"https://api.github.com/users/kobelb/orgs","repos_url":"https://api.github.com/users/kobelb/repos","events_url":"https://api.github.com/users/kobelb/events{/privacy}","received_events_url":"https://api.github.com/users/kobelb/received_events","type":"User","site_admin":false},"labels":[{"id":912940197,"node_id":"MDU6TGFiZWw5MTI5NDAxOTc=","url":"https://api.github.com/repos/elastic/kibana/labels/Feature:Security/Authentication","name":"Feature:Security/Authentication","color":"0e8a16","default":false},{"id":820277882,"node_id":"MDU6TGFiZWw4MjAyNzc4ODI=","url":"https://api.github.com/repos/elastic/kibana/labels/Team:Security","name":"Team:Security","color":"fef2c0","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2019-06-21T22:11:02Z","updated_at":"2019-09-04T15:08:50Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/elastic/kibana/pulls/39477","html_url":"https://github.com/elastic/kibana/pull/39477","diff_url":"https://github.com/elastic/kibana/pull/39477.diff","patch_url":"https://github.com/elastic/kibana/pull/39477.patch"},"body":"The following implements a very rudimentary redirect whenever we receive a 401 response. This does not currently address two exceptional situations which are in the LP, where we ignore the 401s:\r\n1) We have a hard-coded list of API regexs which we always ignore 401s from https://github.com/elastic/kibana/blob/bd4b7a03ea30682d61837f9cacedf221f192b953/x-pack/legacy/plugins/security/public/hacks/on_unauthorized_response.js#L14-L15\r\n2) We have a hard-coded list of page URLs which we explicitly ignore all 401s on https://github.com/elastic/kibana/blob/bd4b7a03ea30682d61837f9cacedf221f192b953/x-pack/legacy/plugins/xpack_main/public/services/path.js#L12\r\n\r\n\r\nWith regard to the hard-coded APIs, we're using this for two endpoints \"login\" and \"change password\". For login, what if we were to add an option to the NP http service to allow consumers to specify `credentials: 'omit'` as an option. That way when we see a 401 from a request where we're using `credentials: 'omit'` we just don't do the redirect. We don't really want or need the cookie sent to the login endpoint, because they'll be getting a new cookie on a successful login. For the change password endpoint, I think we can just change the 401 we return when the user tries to change their own password and doesn't provide the correct old password to a 403. You're forbidden from changing your password if you don't know the old password. I don't really understand the historical reasons for returning a 401 here in the first place.\r\n\r\nWith regard to the page URLs, these are consumed a number of places. They're generally used to ensure that the end-user is logged in before doing things like showing telemetry banners, or polling for reports, etc. This one I don't have a great answer for. All of the pages except for \"/status\" are security pages and the consumers are in x-pack. The security plugin could potentially expose an API to allow consumers to determine the user is currently on an \"unauthenticated page\". I'm open to alternatives here.\r\n\r\n**Depends on new functionality** https://github.com/elastic/kibana/issues/41990\r\n**Blocked by bugs** https://github.com/elastic/kibana/issues/42990 https://github.com/elastic/kibana/issues/42311 https://github.com/elastic/kibana/issues/42307"},"comment":{"url":"https://api.github.com/repos/elastic/kibana/issues/comments/527944937","html_url":"https://github.com/elastic/kibana/pull/39477#issuecomment-527944937","issue_url":"https://api.github.com/repos/elastic/kibana/issues/39477","id":527944937,"node_id":"MDEyOklzc3VlQ29tbWVudDUyNzk0NDkzNw==","user":{"login":"elasticmachine","id":15837671,"node_id":"MDQ6VXNlcjE1ODM3Njcx","avatar_url":"https://avatars3.githubusercontent.com/u/15837671?v=4","gravatar_id":"","url":"https://api.github.com/users/elasticmachine","html_url":"https://github.com/elasticmachine","followers_url":"https://api.github.com/users/elasticmachine/followers","following_url":"https://api.github.com/users/elasticmachine/following{/other_user}","gists_url":"https://api.github.com/users/elasticmachine/gists{/gist_id}","starred_url":"https://api.github.com/users/elasticmachine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elasticmachine/subscriptions","organizations_url":"https://api.github.com/users/elasticmachine/orgs","repos_url":"https://api.github.com/users/elasticmachine/repos","events_url":"https://api.github.com/users/elasticmachine/events{/privacy}","received_events_url":"https://api.github.com/users/elasticmachine/received_events","type":"User","site_admin":false},"created_at":"2019-09-04T15:08:50Z","updated_at":"2019-09-04T15:08:50Z","author_association":"NONE","body":"## :broken_heart: Build Failed\n* [continuous-integration/kibana-ci/pull-request](https://kibana-ci.elastic.co/job/elastic+kibana+pull-request/1016/)\n\n"}}
other: {"actor":{"display_login":"elasticmachine"}}