topic How do I disable redirection warning? in Dashboards & Visualizations

How do I disable redirection warning?

tobelesp — Wed, 31 Aug 2022 14:09:14 GMT

After we upgraded to v9.0.1 we get a warning when following dashboard-generated links pointing "outside" splunk:

Redirecting away from Splunk

You are being redirected away from Splunk to the following URL:

https://[some non-splunk web-server]
Note that tokens embedded in a URL could contain sensitive information.

It comes with a "Don't show again" option, but it indeed shows again every time.
Is there somewhere to disable this warning?

Thanks

Re: How do I disable redirection warning?

andreasz — Tue, 06 Sep 2022 21:41:38 GMT

Apparently Splunk remembers this only for the one row clicked.
I have tables with thousands of rows and redirect columns. So you would have to confirm for every single row. This makes no sense and is not usable.
@splunk: Is there a way to disable this via a .conf file?

Re: How do I disable redirection warning?

tobelesp — Wed, 07 Sep 2022 05:07:50 GMT

Yes, some .conf to whitelist full domains or at least hostnames would be great.

Re: How do I disable redirection warning?

andreasz — Sat, 24 Sep 2022 11:02:02 GMT

There is a new blog article about the topic:
https://www.splunk.com/en_us/blog/platform/improving-security-updates-to-classic-simplexml-dashboards-containing-external-links-or-content.html

But it is not really helpful 😞

And the Dashboards Trusted Domains list (Settings > Server settings > Dashboards Trusted Domains List) seems to be found only in the cloud version.
What about the enterprise customers?

Re: How do I disable redirection warning?

andreasz — Sun, 25 Sep 2022 10:35:26 GMT

I digged a little deeper.

Here is a "run everywhere" demo dashboard.

<dashboard version="1.1"> <label>Link Redirect</label> <row> <panel> <table> <search> <query> | makeresults | eval movie = "Breaking Bad", id = "0903747" | append [| makeresults | eval movie = "Better Call Saul", id = "3032476"] | table movie, id </query> </search> <drilldown> <condition field="movie"> <link target="_blank">http://www.imdb.com/title/tt$row.id$</link> </condition> </drilldown> </table> </panel> </row> </dashboard>

Click on the 1. movie.
Choose "Don't show this again" and Continue.

Now we find the following entry in session storage (Chrome Developer Tools -> Application -> Session Storage):
Key: http://www.imdb.com/title/tt0903747
Value: true

Logout from Splunk and login in the same tab keeps the data.

Closing the tab deletes the entry from the session storage.
You get the same problem, if you open a new splunk tab. The entry is missing for this session.

From Google Search: "Use the local Storage object if you want some data to be on the browser. If you want it on the server, then use cookies, and the session storage is used when you want to destroy the data whenever that specific tab gets closed"

Practically user has to klick "Don't show this again" for every table row, in every browser and for every new tab / session.
How can you explain this to the user?

Re: How do I disable redirection warning?

SmeetsS — Wed, 28 Sep 2022 08:46:46 GMT

We currently have the same problem.

If the only goal is that the user does not have to perform any additional actions, the following code can be added as a .js file to your dashboard:

require([ 'underscore', 'jquery', 'splunkjs/mvc/simplexml/ready!' ], function (_, $) { $(document).click(function(){ setTimeout(function(){ var modal = $("div[data-test='modal']") if (modal !== undefined){ $("div[data-test='modal'] div[data-test='footer'] button[title='Not selected']").click() $("div[data-test='modal'] div[data-test='footer'] button[label='Continue']").click() }},500); }); });

This is by no means a permanent or an efficient solution, but it solves the issue until @splunk provides whitelisting for enterprise edition.

Re: How do I disable redirection warning?

Thibault-C — Wed, 28 Sep 2022 08:51:16 GMT

Works like a charm. 😎

Re: How do I disable redirection warning?

andreasz — Wed, 28 Sep 2022 15:53:49 GMT

Nice workaround.
Thanks!

Re: How do I disable redirection warning?

elizabethl_splu — Fri, 28 Oct 2022 16:30:48 GMT

Hi there, thanks for posting this question! We will be adding a feature flag, as well as UI for adding trusted domains in the next on-prem release, so that you will have more control over redirection modal. Currently, the "do not show this again" applies per user, per session, per specific URL. If the URL changes (e.g. because a token value in the URL changes) the modal will display again. The intention is so that users will have an opportunity to verify they are only passing information they intended to when clicking on a link that redirects them out of Splunk.

Re: How do I disable redirection warning?

freeload101 — Fri, 11 Nov 2022 00:50:13 GMT

not sure we can mark this as a solution...buuut OK... My dashboard's going to be completely broken until then

Re: How do I disable redirection warning?

matzn — Thu, 15 Dec 2022 09:14:35 GMT

Any news on this topic?
I have not found anything within the docs how to deal with this (except for splunk cloud....).

Re: How do I disable redirection warning?

pschildein — Thu, 05 Jan 2023 13:45:42 GMT

Hi, is there also a solution for on-premise installations?

Re: How do I disable redirection warning?

elizabethl_splu — Thu, 05 Jan 2023 17:09:53 GMT

Hi @pschildein, thanks for your question. The Dashboards Trusted Domains list will be made available in the new on-premise release. Unfortunately I do not have release dates to share at this time.

Re: How do I disable redirection warning?

bsayatovic2 — Mon, 20 Feb 2023 20:17:15 GMT

Release dates aside, are we talking about 9.0.5, 9.1 or 10.0?

This has been a user-experience wrecking problem for us since 9.0 came out. These redirect warnings are feature my team never wanted. We build our own dashboards, and we know exactly where they're redirecting to. Our ability to quickly go down a dashboard table and Ctrl+Click (Cmd+Click) the rows that interest us into new tabs has been disrupted.

I can't believe Splunk would add such an obnoxious feature without also adding a way to bypass it at the same time. Atlassian does this all the time. Now Splunk, too?!

Re: How do I disable redirection warning?

elizabethl_splu — Tue, 21 Feb 2023 17:17:49 GMT

Hi @bsayatovic2, thank you for sharing your concerns. This was implemented for security reasons, but I can understand how it would be obnoxious. We are anticipating that the ability to disable this security feature will be available in 9.1, with all the caveats that release timing, release version numbers, and what's included in each version is subject to change.

Re: How do I disable redirection warning?

dbhojani — Tue, 02 May 2023 17:05:23 GMT

Hi,

Is there any way to disable it on splunkcloud?

Re: How do I disable redirection warning?

elizabethl_splu — Tue, 02 May 2023 17:12:39 GMT

In Splunk Cloud 9.0.2303, you'll be able to use the Dashboards Trusted Domains list to suppress the redirection warning for any trusted domains. You'll also have an option to completely disable the redirection warning for dashboards, although that's not recommended since links out of Splunk could contain sensitive information embedded in token values/URL params.

You can check out the release notes here: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2303/DashStudio/WhatNewSC

Re: How do I disable redirection warning?

dbhojani — Tue, 02 May 2023 17:16:34 GMT

Yea,

The dashboard link is not directing to any external URL. It's same splunkcloud platform , but still it doesn't work. I've also added the trusted domain list but no luck. I think it could be possible because of DNS changes.

We are using akamai , so the cloud instance URL is no <stackname>.splunkcloud.com , it's different.

I'll check with splunk support. thanks for quick update 🙂

Re: How do I disable redirection warning?

elizabethl_splu — Tue, 02 May 2023 17:19:43 GMT

The Dashboards Trusted Domains List doesn't apply to redirection warnings until 9.0.2303, which is why it didn't work before. But yeah, if you're not able to use a relative URL for linking within the platform (e.g. /app/search/<dashboardId) then it's treated like an external URL

Re: How do I disable redirection warning?

romux72 — Tue, 27 Jun 2023 07:59:05 GMT

Hi, I see on Documentation that now we have 2 variables on web-features.conf to disable external content restriction.

Enable_dashboards_external_content_restriction and Enable_dashboards_redirection_restriction

but on this section or on web-features.conf specification page, this variables doesn't appear. We don't know which stanza use for that.

https://docs.splunk.com/Documentation/Splunk/9.0.5/Admin/Web-featuresconf#web-features.conf

I meet the same problem. We use many panel html with <style> balise to add dynamic interaction and custom layout with Dashboard XML.