elasticsearch/kibana — pull request #902 by camathieu (2014-02-02 00:19:36+00:00)
Title: allow ajax requests to work with basic http auth

To securize access to Elasticsearch with http basic authentication you need two things to avoid this error :

XMLHttpRequest cannot load http://xxx.tld:9200 No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://xxx.tld' is therefore not allowed access.

1 - Add proper Access-Control-Allow- headers to your proxy configuration

ServerName xxx.tld

DocumentRoot /var/www/jail

SSLEngine on
SSLCertificateFile /etc/apache2/ssl/cert.crt
SSLCertificateKeyFile /etc/apache2/ssl/cert.key
SSLCACertificateFile /etc/apache2/ssl/cert.chain

ProxyRequests Off
ProxyPreserveHost On
ProxyPass / http://xxx.xxx.xxx.xxx:9200/
ProxyPassReverse / http://xxx.xxx.xxx.xxx:9200/

AuthType Basic
AuthBasicProvider file
AuthUserFile /etc/apache2/.htpasswd
require valid-user

Header set Access-Control-Allow-Origin "https://xxx.tld" #Wildcard will not work here
Header set Access-Control-Allow-Methods "GET, OPTIONS"
Header set Access-Control-Allow-Credentials true

Order deny,allow
allow from all

2 - Make $http to send cross domain requests with credentials

set $httpProvider.defaults.withCredentials to true in app.config();