When server.basePath is an empty string, Kibana fails to start up

[rudolf]

kibana.yml:

server.basePath: ''

Logs:

server    log   [00:16:12.533] [fatal][root] { ValidationError: child "path" fails because ["path" is not allowed to be empty]
    at Object.exports.process (/Users/rudolf/dev/kibana/node_modules/joi/lib/errors.js:196:19)
    at internals.Object._validateWithOptions (/Users/rudolf/dev/kibana/node_modules/joi/lib/types/any/index.js:675:31)
    at module.exports.internals.Any.root.validate (/Users/rudolf/dev/kibana/node_modules/joi/lib/index.js:146:23)
    at Object.internals.implementation [as cookie] (/Users/rudolf/dev/kibana/node_modules/hapi-auth-cookie/lib/index.js:94:25)
    at module.exports.internals.Auth.strategy [as _strategy] (/Users/rudolf/dev/kibana/node_modules/hapi/lib/auth.js:52:47)
    at createCookieSessionStorageFactory (/Users/rudolf/dev/kibana/src/core/server/http/cookie_session_storage.ts:144:15)
    at process._tickCallback (internal/process/next_tick.js:68:7)
  isJoi: true,
  name: 'ValidationError',
  details:
   [ { message: '"path" is not allowed to be empty',
       path: [Array],
       type: 'any.empty',
       context: [Object] } ],
  _object:
   { cookie: 'sid',
     password: 'my secure cookie secret is strong enough',
     validateFunc: [AsyncFunction: validateFunc],
     isSecure: false,
     path: '',
     clearInvalid: false,
     isHttpOnly: true,
     isSameSite: false },
  annotate: [Function] }

Workaround:

Remove the server.basePath setting altogether if you don't want to specify a basePath.

[elasticmachine]

Pinging @elastic/kibana-platform (Team:Platform)

[pgayvallet]

kibana/src/core/server/http/http_config.ts

Lines 40 to 44 in bf04235

	basePath: schema.maybe(
	schema.string({
	validate: match(validBasePathRegex, "must start with a slash, don't end with one"),
	})
	),

Seems like an empty string is not considered as a value, therefor the regexp validation is ignored, which is why this explodes later in the createCookieSessionStorageFactory function.

[rudolf]

An empty string is not a valid Joi.string() which is what hapi uses to validate the cookie path, but our regex explicitly allows an empty string $^|....

We could only set the cookie path if the basePath isn't an empty string. But I wonder if it ever makes sense to have an empty basePath, maybe we should just fail configuration validation. Changing the rexexp will also better match the config validation description "must start with a slash, don't end with one".