In the current docs, we show do not really explain the ramifications of changing elasticsearch.requestHeadersWhitelist.

https://www.elastic.co/guide/en/kibana/current/settings.html

elasticsearch.requestHeadersWhitelist:
Default: [ 'authorization' ] List of Kibana client-side headers to send to Elasticsearch. To send no client-side headers, set this value to [] (an empty list).

This is further compounded by the example kibana.yml showing a similar comment:

It sounds a lot more secure to send no headers, but it means that you can never authenticate a request against an instance of Elasticsearch that requires Basic Authentication.

We should probably note that removing the authorization header from being whitelisted means that you cannot use Basic Authentication from Kibana.