[http] Default route access to internal

[TinaHeiligers]

fix #161371
Kibana enforces restricting access to public APIs if a request can't be verified using a header.

By default, Kibana interprets if an API is internal or public based on the route path string if not explicitly set otherwise.

That means that all routes that don't have an internal prefix in the path string become public, and need the header to pass validation in core's server route handler.

We need to change that to rather set the default as internal and allow teams who specifically want their APIs to be public, to declare their route access property as public themselves.

Checklist

• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the [docker list]

Risk Matrix

Risk	Probability	Severity	Mitigation/Notes
Teams who specifically want their APIs as public don't override the default	High	High (serverless)	Integration tests will verify that requests to public APIs without the required header will fail.

[TinaHeiligers]

cc @jloleysens Here's the draft for relaxing API restrictions

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: bf9b14a

Metrics [docs]

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
enterpriseSearch	14	16	+2
securitySolution	409	413	+4
total			+6

Total ESLint disabled count

id	before	after	diff
enterpriseSearch	15	17	+2
securitySolution	488	492	+4
total			+6

History

• 💔 Build #141641 failed 9d1174b

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[pgayvallet]

LGTM