# Elasticsearch security

**URL:** <https://discuss.elastic.co/t/elasticsearch-security/92750>\
**Category:** Elasticsearch\
**Created:** [July 12, 2017, 4:17am UTC](https://discuss.elastic.co/t/elasticsearch-security/92750 "2017-07-12T04:17:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Huy\_Hoang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/huy_hoang/32/19986_2.png) [@Huy\_Hoang](https://discuss.elastic.co/u/Huy_Hoang)\
**Post date:** [July 12, 2017, 4:17am UTC](https://discuss.elastic.co/t/elasticsearch-security/92750/1 "2017-07-12T04:17:29Z")

</div>

I know this's kinda a silly question. But how I can secure elasticsearch server in the front end view. For example, I have to collect the user's data in the front and, that being said, every time user clicks a button or write something, we send the post request including the the data to the elasticsearch server to process.  
So go back to the question, how can I protect the server while it has to be public to be used.  
Should I make and proxy between the two, or any suggestion?

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 12, 2017, 4:57am UTC](https://discuss.elastic.co/t/elasticsearch-security/92750/2 "2017-07-12T04:57:24Z")

</div>

We'd recommend you use [https://www.elastic.co/guide/en/x-pack/current/xpack-security.html](https://www.elastic.co/guide/en/x-pack/current/xpack-security.html)

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [July 12, 2017, 7:13am UTC](https://discuss.elastic.co/t/elasticsearch-security/92750/3 "2017-07-12T07:13:52Z")

</div>

Normally you have an application in the middle. The application communicates with elasticsearch. Not the end user.

I mean that I'd not expose my elasticsearch instance to the public directly. Like a database which is normally running in the backend network.

X-Pack (commercial) is something you need to look at wherever you put elasticsearch (back or front).

My 2 cents

---

<div class="post-metadata">

**Author:** ![Huy\_Hoang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/huy_hoang/32/19986_2.png) [@Huy\_Hoang](https://discuss.elastic.co/u/Huy_Hoang)\
**Post date:** [July 12, 2017, 7:45am UTC](https://discuss.elastic.co/t/elasticsearch-security/92750/4 "2017-07-12T07:45:57Z")

</div>

Thanks for all the recommendations, but still, even I have an application/server in the middle, if the hacker gets the pattern of the request in frontend, they can easily make more request and spam our, like add more document into the database. And elastic can't help with that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 9, 2017, 7:46am UTC](https://discuss.elastic.co/t/elasticsearch-security/92750/5 "2017-08-09T07:46:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.