# Is api/security/login still in Kibana 8.10.2?

**URL:** <https://discuss.elastic.co/t/is-api-security-login-still-in-kibana-8-10-2/344165>\
**Category:** Kibana\
**Created:** [September 30, 2023, 2:53am UTC](https://discuss.elastic.co/t/is-api-security-login-still-in-kibana-8-10-2/344165 "2023-09-30T02:53:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![michael\_jaskiewicz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_jaskiewicz/32/98514_2.png) [@michael\_jaskiewicz](https://discuss.elastic.co/u/michael_jaskiewicz)\
**Post date:** [September 30, 2023, 2:53am UTC](https://discuss.elastic.co/t/is-api-security-login-still-in-kibana-8-10-2/344165/1 "2023-09-30T02:53:13Z")

</div>

I'm trying to embed an iframe in a page of mine and I was getting CORS errors while doing a login request on /api/security/login so that the user doesn't have to log in multiple times. I think I worked through most of them, however the preflight options request gets a 404 response with a message "It does not have HTTP ok status."

This message is pretty cryptic to me so I'm assuming that maybe /api/security/login was changed somehow? The 404 tells me it can't find something...

JavaScript

```auto
    const headerObj = {};
    headerObj['kbn-xsrf'] = 'true';
    headerObj['Content-Type'] = 'application/json'
    axios.post(`http://redacted:5601/api/security/login`, {username: 'redacted', password: 'redacted'},
      {headers: headerObj}).then((res) => {

    })

```

kibana.ini

```auto
  kibana.yml: |-
    server.name: kibana
    server.host: "0.0.0.0"
    elasticsearch.hosts: ["https://elasticsearch:9200"]
    elasticsearch.username: kibana
    elasticsearch.password: redacted
    elasticsearch.ssl.verificationMode: none

    server.cors.enabled: true
    server.cors.allowCredentials: true
    server.cors.allowOrigin: ["http://localhost:3000"]
    server.customResponseHeaders: {"Access-Control-Allow-Origin": "http://localhost:3000", "Access-Control-Allow-Credentials": "true" }

```

---

<div class="post-metadata">

**Author:** ![michael\_jaskiewicz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_jaskiewicz/32/98514_2.png) [@michael\_jaskiewicz](https://discuss.elastic.co/u/michael_jaskiewicz)\
**Post date:** [September 30, 2023, 10:00pm UTC](https://discuss.elastic.co/t/is-api-security-login-still-in-kibana-8-10-2/344165/2 "2023-09-30T22:00:34Z")

</div>

I figured it out, kinda. I used a different route: internal/security/login. I'm sure it's not the right one, but it works.

```auto
    headerObj['kbn-xsrf'] = 'true';
    headerObj['Content-Type'] = 'application/json'
    axios.post(`http://redacted:5601/internal/security/login`, loginPayload,
      {headers: headerObj}).then((res) => {

    }).catch(err => {

    })

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 28, 2023, 10:01pm UTC](https://discuss.elastic.co/t/is-api-security-login-still-in-kibana-8-10-2/344165/3 "2023-10-28T22:01:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.