We need to create a global allow list of external URLs to which Kibana users will be allowed to navigate away from Kibana. One user of such service will be URL drilldown but I believe there are many more potential users. For example, all Markdown links could be checked against this allow list before navigating to an external URL.

Food for thought:

• The service could be opt-in or opt-out.
• List of allowed external URLs* could live in kibana.yml.
• How granular should we verify the URL? Should we verify origin—protocol + domain + port?
• Should we support wildcards http://google.com/*?
• Shall there be an option to allow all URLs *?
• Will the service be available on client or server? Or only on the server?

I'm pinging Security and Platform teams as in our discussion these two teams were considered as likely owners of this service.