# Kibana embedded dashboard in iframe returns 401 Unauthorized loop - anonymous auth works directly but not in iframe

**URL:** <https://discuss.elastic.co/t/kibana-embedded-dashboard-in-iframe-returns-401-unauthorized-loop-anonymous-auth-works-directly-but-not-in-iframe/384815>\
**Category:** Kibana\
**Created:** [January 30, 2026, 7:54am UTC](https://discuss.elastic.co/t/kibana-embedded-dashboard-in-iframe-returns-401-unauthorized-loop-anonymous-auth-works-directly-but-not-in-iframe/384815 "2026-01-30T07:54:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Oscar\_NT](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oscar_nt/32/140627_2.png) [@Oscar\_NT](https://discuss.elastic.co/u/Oscar_NT)\
**Post date:** [January 30, 2026, 7:54am UTC](https://discuss.elastic.co/t/kibana-embedded-dashboard-in-iframe-returns-401-unauthorized-loop-anonymous-auth-works-directly-but-not-in-iframe/384815/1 "2026-01-30T07:54:24Z")

</div>

**Environment:**

- Elastic Cloud (Hosted)
- Kibana version: 8.x (Cloud managed)
- Browser: Chrome / Safari
- Frontend: Next.js app running on `https://localhost:3000` (HTTPS with mkcert)

* * *

**Problem:**

I'm trying to embed a Kibana dashboard in an iframe using anonymous authentication.

- ✅ **Direct browser access works** - Dashboard loads without login
- ❌ **iframe embedding fails** - Continuous 401 Unauthorized loop

Error in browser console:

```auto
GET /internal/security/user_profile?dataPath=avatar,userSettings 401 (Unauthorized)

```

* * *

**My Kibana Configuration:**

```yaml
xpack.security.authc.providers:
  anonymous.anonymous1:
    order: 0
    credentials:
      username: "my-frontend-user"
      password: "my-password"

xpack.security.sameSiteCookies: "None"

```

* * *

**iframe Code:**

```html
<iframe
 src="https://deployment-id.asia-northeast123.gcp.cloud.es.io/app/dashboards?auth_provider_hint=anonymous1#/view/21718d8c-112b-4836-1233-a6d4612312303?embed=true&_g=(refreshInterval%3A(pause%3A!t%2Cvalue%3A60000)%2Ctime%3A(from%3Anow-15m%2Cto%3Anow))"
  height="600"
  width="800"
></iframe>

```

* * *

**What I've Tried:**

1. ✅ Confirmed `anonymous1` provider appears in `/internal/security/login_state`
2. ✅ Direct browser access works (anonymous auth is functional)
3. ✅ Using HTTPS on localhost (mkcert certificates)
4. ✅ Set `xpack.security.sameSiteCookies: "None"`

* * *

**Questions:**

1. Is the 401 error caused by cookies not being sent in the cross-origin iframe context, even with `SameSite=None`? If so, is a reverse proxy the only secure solution?

2. Are there any Elastic Cloud-specific configurations or features for securely embedding dashboards?

---

<div class="post-metadata">

**Author:** ![Oscar\_NT](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oscar_nt/32/140627_2.png) [@Oscar\_NT](https://discuss.elastic.co/u/Oscar_NT)\
**Post date:** [January 30, 2026, 7:58am UTC](https://discuss.elastic.co/t/kibana-embedded-dashboard-in-iframe-returns-401-unauthorized-loop-anonymous-auth-works-directly-but-not-in-iframe/384815/2 "2026-01-30T07:58:17Z")

</div>

I try firefox it is ok but chrome not.