Skip to content

Commit fbeba3e

Browse files
Change DELETE to POST for _bulk_delete to avoid incompatibility issues (#87914) (#88509)
## Summary Changes `DELETE` to `POST` for _bulk_delete on the client only for a variety of reasons. According to the RFC, not all servers and proxies need to honor DELETE having a body. From: https://tools.ietf.org/html/rfc7231 ``` A payload within a DELETE request message has no defined semantics; sending a payload body on a DELETE request might cause some existing implementations to reject the request. ``` Within at least one proxy, h2o2, we have found that it does indeed change request headers which will cause NodeJS to not attach the body of a `DELETE`: hapijs/h2o2#124 Also from other communities such as OpenAPI where they debated this, they allow it but discourage it for reasons outlined there that I will not repeat here: OAI/OpenAPI-Specification#1937 Elastic Search API's and other Kibana API's use `POST` rather than `DELETE` for their bodies that are attached to `DELETE`: https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html We still support bodies in `DELETE` and `POST` but are just changing the web client to utilize `POST` moving forward. ### Checklist Reviewed and we already have unit tests and end to end tests for these use cases so we are good with just updating them. - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
1 parent 0d7e389 commit fbeba3e

File tree

3 files changed

+3
-3
lines changed

3 files changed

+3
-3
lines changed

x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.test.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -377,7 +377,7 @@ describe('Detections Rules API', () => {
377377
await deleteRules({ ids: ['mySuperRuleId', 'mySuperRuleId_II'] });
378378
expect(fetchMock).toHaveBeenCalledWith('/api/detection_engine/rules/_bulk_delete', {
379379
body: '[{"id":"mySuperRuleId"},{"id":"mySuperRuleId_II"}]',
380-
method: 'DELETE',
380+
method: 'POST',
381381
});
382382
});
383383

x-pack/plugins/security_solution/public/detections/containers/detection_engine/rules/api.ts

+1-1
Original file line numberDiff line numberDiff line change
@@ -205,7 +205,7 @@ export const enableRules = async ({ ids, enabled }: EnableRulesProps): Promise<B
205205
*/
206206
export const deleteRules = async ({ ids }: DeleteRulesProps): Promise<BulkRuleResponse> =>
207207
KibanaServices.get().http.fetch<Rule[]>(`${DETECTION_ENGINE_RULES_URL}/_bulk_delete`, {
208-
method: 'DELETE',
208+
method: 'POST',
209209
body: JSON.stringify(ids.map((id) => ({ id }))),
210210
});
211211

x-pack/plugins/security_solution/server/lib/detection_engine/scripts/delete_bulk.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,6 @@ curl -s -k \
1717
-H 'Content-Type: application/json' \
1818
-H 'kbn-xsrf: 123' \
1919
-u ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD} \
20-
-X DELETE ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_delete \
20+
-X POST ${KIBANA_URL}${SPACE_URL}/api/detection_engine/rules/_bulk_delete \
2121
-d @${RULES} \
2222
| jq .;

0 commit comments

Comments
 (0)