From e1f213f4af5f46dd6ee4870f8baec663ce7a99fe Mon Sep 17 00:00:00 2001
From: "Grot (@grafanabot)" <43478413+grafanabot@users.noreply.github.com>
Date: Thu, 14 Jan 2021 09:28:20 +0100
Subject: [PATCH] Auth: Add missing request headers to SigV4 middleware
 allowlist (#30115) (#30270)

* Auth: Add Content-Type to SigV4 header allowlist

* add MT headers to permitted headers

* add Kibana API header to allowlist

* add Content-Length header to allow list

(cherry picked from commit a0a1422b2dc37207324452ac33ddc0359b7c90c6)

Co-authored-by: Will Browne <wbrowne@users.noreply.github.com>
---
 pkg/models/sigv4.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkg/models/sigv4.go b/pkg/models/sigv4.go
index 1d1695ce933..352c5fd702d 100644
--- a/pkg/models/sigv4.go
+++ b/pkg/models/sigv4.go
@@ -33,6 +33,11 @@ var permittedHeaders = map[string]struct{}{
 	"User-Agent":      {},
 	"Accept":          {},
 	"Accept-Encoding": {},
+	"Content-Type":    {},
+	"Content-Length":  {},
+	"securitytenant":  {},
+	"sgtenant":        {},
+	"kbn-xsrf":        {},
 }
 
 type SigV4Middleware struct {