# Limit anonymous user's ability on embedded Kibana dashboard

**URL:** https://discuss.elastic.co/t/limit-anonymous-users-ability-on-embedded-kibana-dashboard/366240
**Category:** Kibana
**Tags:** dashboard
**Created:** [September 9, 2024, 11:04am UTC](https://discuss.elastic.co/t/limit-anonymous-users-ability-on-embedded-kibana-dashboard/366240 "2024-09-09T11:04:11Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Muhammad\_Adil\_Talay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/muhammad_adil_talay/32/121792_2.png) [@Muhammad\_Adil\_Talay](https://discuss.elastic.co/u/Muhammad_Adil_Talay)
#### Post date: [September 9, 2024, 11:04am UTC](https://discuss.elastic.co/t/limit-anonymous-users-ability-on-embedded-kibana-dashboard/366240/1 "2024-09-09T11:04:11Z")

</div>

Hi, I'm following this tutorial on Elastic blog to embed Kibana dashboard on my website. I expect only the dashboard to appear using this method. However, the Elasticsearch bar, side bar and some other items also appear.

 ![kibana-dashboard-strange](https://us1.discourse-cdn.com/elastic/original/3X/5/2/5288d55178099c88470e46c9f0b81641e7b8ade7.png)

The problem with this is that the user can navigate to other dashboards that I'd like to restrict them from accessing.

The steps I follow are:

1. Create a new user: anomymous\_user. Grant it a role with two privileges: (1) Elasticsearch Index privileges (for selected Indices): read, (2) Kibana Custom privileges: Read for Dashboards.
2. I update the kibana.yml file by adding the anonymous user credentials in the anonymous authentication config. Also, set sameSiteCookies to None.

Is this a problem in generation of iframe or is it something else, any fixes?

---

<div class="post-metadata">

### Author: ![jsanz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsanz/32/53734_2.png) [@jsanz](https://discuss.elastic.co/u/jsanz)
#### Post date: [September 9, 2024, 1:00pm UTC](https://discuss.elastic.co/t/limit-anonymous-users-ability-on-embedded-kibana-dashboard/366240/2 "2024-09-09T13:00:52Z")

</div>

In the iframe you can prevent UI from showing the sidebar with the `embed=true` parameter as you can see in this dashboard I have in a public space

[https://ela.st/cumbre-vieja-eruption](https://ela.st/cumbre-vieja-eruption)

However, as you can experiment in the dashboard above, nothing prevents you from removing the dashboard path from your browser address bar and accessing any other assets shared in that space with the anonymous user. Of course, it is not self-evident in an iframe, but also not super-hard to guess.