# Kibana iframe request origin (client or server side)

**URL:** <https://discuss.elastic.co/t/kibana-iframe-request-origin-client-or-server-side/249368>\
**Category:** Kibana\
**Created:** [September 21, 2020, 1:40pm UTC](https://discuss.elastic.co/t/kibana-iframe-request-origin-client-or-server-side/249368 "2020-09-21T13:40:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ayden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ayden/32/51432_2.png) [@Ayden](https://discuss.elastic.co/u/Ayden)\
**Post date:** [September 21, 2020, 1:40pm UTC](https://discuss.elastic.co/t/kibana-iframe-request-origin-client-or-server-side/249368/1 "2020-09-21T13:40:50Z")

</div>

Hello,

I was recently looking to embed Kibana dashboards in a web application.  
In my current setup, Kibana is in a private network and the web application will be in a different host publicly accessible. The clients won't have access to the private network but the web application host can.

So my question is: Are the iframe requests made from the server or client-side? Or does this depend on my implementation of the iframes?  
In the case requests are client-side does it also mean I have to move the Kibana instance to a public accessible instance?

Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Mikhail\_Shustov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mikhail_shustov/32/49186_2.png) [@Mikhail\_Shustov](https://discuss.elastic.co/u/Mikhail_Shustov)\
**Post date:** [September 23, 2020, 10:46am UTC](https://discuss.elastic.co/t/kibana-iframe-request-origin-client-or-server-side/249368/2 "2020-09-23T10:46:12Z")

</div>

Could you clarify a couple of moments, please?

> [@Ayden](#):
>
> Are the iframe requests made from the server or client-side?

Do you mean requests to Elasticsearch or Kibana?  
The topology looks like:  
Kibana app --\> Load Balancer(optional) --\> Kibana Server --\> Elasticsearch  
Kibana application performs most of the requests to Elasticsearch (we should remove all the direct calls to the ES server from the browser in the upcoming release) thorough the Kibana server, so I believe your setup should work if your load balancer can redirect an incoming request to the Kibana server.

> In the case requests are client-side does it also mean I have to move the Kibana instance to a public accessible instance?

Is there any problem with this approach if you enable Security in Kibana?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 21, 2020, 10:46am UTC](https://discuss.elastic.co/t/kibana-iframe-request-origin-client-or-server-side/249368/3 "2020-10-21T10:46:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.