# How to protect dashboard url from eavesdroping? **URL:** \ **Category:** Kibana\ **Created:** [June 5, 2018, 6:55am UTC](https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539 "2018-06-05T06:55:23Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Post date:** [June 5, 2018, 6:55am UTC](https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539/1 "2018-06-05T06:55:24Z")
Hi, I embed the dashboard iframe to a custom web page, but I am afraid that the url is eavesdroping if some people with bad intentions get the url directly. But I don't want users key in the password every time when the person login to the custom web page.How can I do? thank you in advance! ---
**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Post date:** [June 5, 2018, 7:38am UTC](https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539/2 "2018-06-05T07:38:50Z")
I have installed x-pack, and I found that every time I log in I need to retype account and password. I think it's a little inconvenient for users. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [June 5, 2018, 2:20pm UTC](https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539/3 "2018-06-05T14:20:32Z")
> Hi, I embed the dashboard iframe to a custom web page, but I am afraid that the url is eavesdroping if some people with bad intentions get the url directly. But I don't want users key in the password every time when the person login to the custom web page.How can I do? Is there specific information that you're not wanting to disclose via the URL that you're using with the iframe? > I have installed x-pack, and I found that every time I log in I need to retype account and password. > I think it's a little inconvenient for users. We store the login information in a cookie that by default doesn't timeout but it is tied to the browser's session storage, so if you close down the browser and re-open it then you'll have to log back in. Do you have `xpack.security.sessionTimeout` set in your Kibana.yml? ---
**Author:** ![f26227279](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/f26227279/32/21296_2.png) [@f26227279](https://discuss.elastic.co/u/f26227279)\ **Post date:** [June 6, 2018, 6:45am UTC](https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539/4 "2018-06-06T06:45:52Z")
ok, I got it . Just hope when I enter my external page and load kibana iframe, it needn't type the account and password, and other people can't directly enter the kibana url. ---
**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\ **Post date:** [June 6, 2018, 11:20am UTC](https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539/5 "2018-06-06T11:20:15Z")
@f26227279 if you have security enabled in Kibana/Elasticsearch, users will always have to login to be able to use Kibana/Elasticsearch, even if Kibana is in an iframe. If you'd like to embed a secured instance of Kibana in an iframe and not require users to login, you can create a user that has read-only access to Kibana and put a reverse-proxy in-front of Kibana that provides the username/password through Basic Auth header as discussed [here](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/4) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 4, 2018, 11:20am UTC](https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539/6 "2018-07-04T11:20:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.