# Kibana/ES security: full proxy mode?
**URL:** https://discuss.elastic.co/t/kibana-es-security-full-proxy-mode/46041
**Category:** Kibana
**Created:** [April 1, 2016, 10:03am UTC](https://discuss.elastic.co/t/kibana-es-security-full-proxy-mode/46041 "2016-04-01T10:03:24Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@mguiwin](https://discuss.elastic.co/u/mguiwin)
#### Post date: [April 1, 2016, 10:03am UTC](https://discuss.elastic.co/t/kibana-es-security-full-proxy-mode/46041/1 "2016-04-01T10:03:24Z")
Hello,
It seems like Kibana calls ES APIs directly from the browser, through a proxified ES endpoint (e.g.,
/kibana/elasticsearch/\_mget...). That Kibana ES proxy allows accessing any ES URL, including plugins (e.g., /kibana/elasticsearch/\_plugin/kopf/#!/cluster).
This makes it hard to make Kibana secured and "read-only" using a reverse proxy (for those not opting for Shield), and prevent users from calling ES APIs directly (even though they are proxified by Kibana).
I know that Grafana has a setting "Access" with options:
Proxy = access via Grafana backend, Direct = access directory from browser.
Would not that be possible to have a similar option in Kibana, so Kibana would do server-to-server calls to ES APIs, without exposing all ES functions to end-users?
Thanks,
MG
---
### Author:  [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)
#### Post date: [April 1, 2016, 8:47pm UTC](https://discuss.elastic.co/t/kibana-es-security-full-proxy-mode/46041/2 "2016-04-01T20:47:00Z")
Our future plans for Kibana are to remove the proxy in favor of a more restricted REST API. Doing so allows for more control over the data and compatibility surface-area with ES.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:57pm UTC](https://discuss.elastic.co/t/kibana-es-security-full-proxy-mode/46041/3 "2017-07-06T13:57:07Z")