# How to protect dashboard url from eavesdroping?

**URL:** <https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539>\
**Category:** Kibana\
**Created:** [June 5, 2018, 6:55am UTC](https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539 "2018-06-05T06:55:23Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [June 6, 2018, 11:20am UTC](https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539/5 "2018-06-06T11:20:15Z")

</div>

@f26227279 if you have security enabled in Kibana/Elasticsearch, users will always have to login to be able to use Kibana/Elasticsearch, even if Kibana is in an iframe.

If you'd like to embed a secured instance of Kibana in an iframe and not require users to login, you can create a user that has read-only access to Kibana and put a reverse-proxy in-front of Kibana that provides the username/password through Basic Auth header as discussed [here](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/4)

---

_[View the full topic](https://discuss.elastic.co/t/how-to-protect-dashboard-url-from-eavesdroping/134539)._