Defend against undesired forms of iframe embedding

[spalger]

A desire for reimplementing the X-Frame-Options header has popped up, but as it conflicts with the embed/share features I was thinking about ways Kibana could be more defensive against undesired forms of iframe embedding.

1. What if Kibana could automatically go into "embed mode" anytime it is rendered within an iframe. The method for determining this would have to be researched, but it's got to be possible.
2. routes that support embed mode would need to be marked as such, and any other route would instead render a "this route does not work in embed mode" message, offering a link to the url that is instructed to open in the top-level window

This way, we can have cross-domain iframe sharing of visualizations and dashboard, but if someone tries to embed the user-management app in an iframe it won't work.

[savva-k]

Is there a way to add X-Frame-Options to Kibana app now? I'm trying to fit in our security policy and need to have this header set.

[spalger]

@savva-k there isn't a supported method to configure this in Kibana, but putting a proxy like nginx in front of Kibana and adding the header there is always a supported option.

[epixa]

@savva-k I just merged in the ability to set custom response headers for the Kibana server, which you could use to set an x-frame-options header. The PR was #13045

It should go out in 6.0.0-beta1 and 5.6.0

[legrego]

Ping @elastic/kibana-security since we weren't automatically mentioned on this older issue.
We have first-class support to enable/disable embedding across all of Kibana, but this issue is discussing whether we'd want to allow applications/routes to opt in/out of embedding

[legrego]

This issue has been open since 2016, and there doesn't appear to be a strong interest at this time. I'm going to close for the time being, but we can reopen if priorities change.

Administrators can control whether or not they wish for Kibana as a whole to be embeddable via server.securityResponseHeaders.disableEmbedding, which was added via #97158 in 7.13.0. X-Frame-Options has also been an option since 5.6.0. These options aren't as flexible as the original request, but they are sufficient for the time being.