Remove osd-name from response headers

[tmarkley]

This is a draft PR to gather feedback.

Description

Addresses a potential security risk where the header could be used for targeted attacks. Depending on the deployment configuration, this header may include the IP address of the host. The header is included even if an error response is returned, meaning that it's possible that anyone could get access to this information, even if they are not authenticated/authorized to access the Dashboards instance.

As for why this header exists in the first place, I dug back through the commit history and found this comment attach the app name to the server, so we can be sure we are actually talking to kibana here (which was merged to the main repo): https://github.com/pgayvallet/kibana/blob/ec481861799ed8dcced9cafd8112e5b26e641c54/src/legacy/server/http/index.js#L63

However, there aren't any references that I could find in our code base or for any plugins that require this header. I can keep digging for more information.

Testing

Issues Resolved

N/A - security risk

Check List

• New functionality includes testing.
  • All tests pass
• New functionality has been documented.
  • New functionality has javadoc added
• Commits are signed per the DCO using --signoff

[opensearch-ci-bot]

✅   DCO Check Passed 17002b1

[kavilla]

This has no impact in the application? Do plugins consume it?

[tmarkley]

This has no impact in the application? Do plugins consume it?

@kavilla I did some basic smoke tests and everything was fine. I also searched across repos for both "osd-name" and "kbn-name" and didn't find anything. I can post that information in the description.

[galangel]

@tmarkley Hi, can you elaborate on why this header was necessary or give some examples of the possible exploit?
I'm just not sure why it was there in the first place.

[tmarkley]

@tmarkley Hi, can you elaborate on why this header was necessary or give some examples of the possible exploit?

I'm just not sure why it was there in the first place.

@galangel Yeah, great question. Depending on the deployment configuration, this header can actually include the IP address of the host. The header is included even if an error response is returned, meaning that it's possible that anyone could get access to this information, even if they are not authenticated/authorized to access the Dashboards instance.

As for why it was there, I had to dig back through the commit history to try to figure that out. The only information I've found thus far was the comment 'attach the app name to the server, so we can be sure we are actually talking to kibana' here (which was merged to the main repo): https://github.com/pgayvallet/kibana/blob/ec481861799ed8dcced9cafd8112e5b26e641c54/src/legacy/server/http/index.js#L63

However, there aren't any references that I could find in our code base or for any plugins that require this header. I can keep digging for more information.

[tmarkley]

Closing for now - we want to be hesitant with breaking changes for our 1.x releases, there is a known workaround (changing the http config name), and this only applies to a small subset of environments.