Fix fleet route protections (#85626)

Co-authored-by: Kibana Machine <[email protected]>
elastic · Dec 13, 2020 · 668f4d5 · 668f4d5
1 parent a2771a3
commit 668f4d5
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/x-pack/plugins/fleet/server/routes/security.ts b/x-pack/plugins/fleet/server/routes/security.ts
@@ -14,7 +14,12 @@ export function enforceSuperUser<T1, T2, T3>(
     const security = appContextService.getSecurity();
     const user = security.authc.getCurrentUser(req);
     if (!user) {
-      return res.unauthorized();
+      return res.forbidden({
+        body: {
+          message:
+            'Access to Fleet API require the superuser role, and for stack security features to be enabled.',
+        },
+      });
     }
 
     const userRoles = user.roles || [];