title: Is it safe to expose the Elasticsearch Search API directly through your application's API?
body: <p>I am developing an AngularJS app with a Java/Spring Boot API. It uses Spring Data Elasticsearch to provide access to Elasticsearch's Search API for searching. Here is an example:</p>
  
  <pre><code>Page&lt;Address&gt; page = addressSearchRepository.search(simpleQueryStringQuery(query), pageable);
  </code></pre>
  
  <p>The variable <code>query</code> is a user's search string. <code>pageable</code> is an object that specifies page number, page size, and sorting. I can use <code>QueryBuilders</code> to build other Elasticsearch queries and expose them as different API endpoints.</p>
  
  <p>Another option is to use <code>QueryBuilders.wrapperQuery</code> and send Elasticsearch queries directly from JavaScript. Here is an example where <code>jsonQuery</code> is a string containing a full Elasticsearch query:</p>
  
  <pre><code>Page&lt;Address&gt; page = addressSearchRepository.search(wrapperQuery(jsonQuery), pageable);
  </code></pre>
  
  <p>This would be a secure endpoint that only authenticated users can access. This seems to be equivalent to exposing an Elasticsearch index's Search API directly. Assuming that any data in the index is safe to show the user, would this be a security risk?</p>
  
  <p>In my research so far I've found that it may be possible to crash Elasticsearch using a query, but it isn't that big of a problem in newer versions: <a href="https://www.elastic.co/blog/found-crash-elasticsearch#arbitrary-large-size-parameter" rel="noreferrer">https://www.elastic.co/blog/found-crash-elasticsearch#arbitrary-large-size-parameter</a></p>
  
  <p>Maybe limiting the page size or using the scan and scroll API when the page size is very large would mitigate this. </p>
  
  <p>I know that script fields should be avoided at all costs, but they are disabled by default (as of v1.4.3).</p>