Viewing Canvas workpads causes incorrect session timeout

[legrego]

Kibana version: Tested on 7.5.1 and 7.5.3, likely exists in other versions.

Describe the bug:
When Kibana is configured to use an auth provider which leverages the ES Token service (essentially anything except the basic auth provider), then viewing a Canvas workpad will eventually fail for users due to an expired session.

Kibana's security plugin is responsible for automatically refreshing these token-backed sessions, but the /api/interpreter/fns route has special handling which is preventing the security plugin from sending the updated session cookie to the end-user.

When viewing a Canvas workpad on auto-refresh, often the only request made to Kibana is /api/interpreter/fns. Since this is the only route getting hit, and this route does not send the cookie correctly, we end up ending the user's session.

Steps to reproduce:

1. Configure Kibana with the token auth provider, or similar provider
2. Create Canvas workpad, set to auto-refresh. It's important that this workpad does not use a Timelion data source.
3. Wait 20 minutes
4. Notice the workpad fails to update after ~20 minutes, and the user session is terminated.

Expected behavior:
The session should be refreshed via a Set-Cookie response header, like all other Kibana routes.

Any additional context:
https://discuss.elastic.co/t/losing-a-session-in-a-canvas

Big thanks to Dennis_Rietvink for reporting and helping diagnose the issue.

Workaround
Including a timelion expression as part of your workpad should workaround this issue, as this calls a different endpoint, which correctly handles session updates.

/cc @elastic/kibana-security

[elasticmachine]

Pinging @elastic/kibana-canvas (Team:Canvas)

[cskowronnek]

Any news here?

[Kuznietsov]

@legrego, I've checked this issue on main. Right now the route has changed and its handler too.

kibana/x-pack/plugins/canvas/server/routes/functions/functions.ts

Line 20 in 0ef0532

router.get(

For now, it doesn't have any special logic for handling the response.

I've tested it by adding further options to kibana.yml:

xpack.security.authc.providers:
  token.token1:
    order: 0

and running elasticsearch with options:

yarn es snapshot --license trial -E xpack.security.authc.token.enabled=true -E xpack.security.authc.token.timeout=120s

and kibana by running command:

yarn start --run-examples

Could you, please, check if it can be closed?

cc @crob611.

[crob611]

Closing this issue. It appears to have been fixed by #74885 which introduced a replacement for /api/interpreter/fns on the Canvas side which does not have custom route handling and so it gets the updated session id.

The fix went into 7.10 so it should be available from there on.

Please re-open this issue if anyone runs into more issues with this.

[legrego]

Thanks folks! ❤️