# Logging into Kibana from a React page using /api/security/v1/login
**URL:** https://discuss.elastic.co/t/logging-into-kibana-from-a-react-page-using-api-security-v1-login/95018
**Category:** Kibana
**Created:** [July 28, 2017, 10:09pm UTC](https://discuss.elastic.co/t/logging-into-kibana-from-a-react-page-using-api-security-v1-login/95018 "2017-07-28T22:09:24Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Sannj](https://discuss.elastic.co/u/Sannj)
#### Post date: [July 28, 2017, 10:09pm UTC](https://discuss.elastic.co/t/logging-into-kibana-from-a-react-page-using-api-security-v1-login/95018/1 "2017-07-28T22:09:24Z")
Hi,
We are trying to log into an embedded dashboard in a react page using the '/api/security/v1/login' API. The API works properly and sets the 'sid' cookie but, the browser is not able to use it because the 'httpOnly' flag set to true. We have a work around where we submit a hidden form the timing is off and login doesn't actually happen automatically unless the page is refreshed.
Any thoughts on how to make auto-login work using the API?
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [July 31, 2017, 2:02pm UTC](https://discuss.elastic.co/t/logging-into-kibana-from-a-react-page-using-api-security-v1-login/95018/2 "2017-07-31T14:02:47Z")
Hi @Sannj,
that is definitely a problematic area of Kibana in combination with X-Pack. Usually we recommend one of two approaches:
- Use a reverse proxy for accessing the dashboards that injects an `Authorization` header.
- Use an ajax request before loading the iframes, which calls the API with the `Authorization` header to have the cookie set in the browser session.
From your description it sounds like you already tried the second approach. Could you elaborate what you mean by "the browser is not able to use it"?
---
### Author:  [@samphibian](https://discuss.elastic.co/u/samphibian)
#### Post date: [July 31, 2017, 4:33pm UTC](https://discuss.elastic.co/t/logging-into-kibana-from-a-react-page-using-api-security-v1-login/95018/3 "2017-07-31T16:33:10Z")
Hi @weltenwort,
When we make the request (I'm on a team with @Sannj ), the browser shows that the cookie has been set. However, the iframe doesn't login and we can't see the cookie in the response. When we look at the set-cookie object, it has the `httpOnly` flag set to true, which we've been informed is probably what is stopping our auto-login.
---
### Author:  [@samphibian](https://discuss.elastic.co/u/samphibian)
#### Post date: [July 31, 2017, 6:29pm UTC](https://discuss.elastic.co/t/logging-into-kibana-from-a-react-page-using-api-security-v1-login/95018/4 "2017-07-31T18:29:52Z")
Here is the response we log:
In the browser, this is what we see when we look at the network response:
We have tried it with the username/password in the body and with the `Authorization` header, both of which gave the same response.
---
### Author:  [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [August 1, 2017, 9:13am UTC](https://discuss.elastic.co/t/logging-into-kibana-from-a-react-page-using-api-security-v1-login/95018/5 "2017-08-01T09:13:58Z")
I was able to get the cookie to be set in the browser session via a xhr request like the following:
```javascript
fetch("https://HOSTNAME/api/security/v1/login", {
body: JSON.stringify({
username: "USERNAME",
password:"PASSWORD",
}),
credentials: 'include',
headers: {
"kbn-version": "5.5.1",
},
method: "POST",
})
```
Depending on the location where the page running the JavaScript is served from, you might have to adjust the CORS settings of Kibana. Note the `credentials: 'include'` setting of the request, which was crucial for getting the browser to persist the `sid` cookie.
---
### Author:  [@samphibian](https://discuss.elastic.co/u/samphibian)
#### Post date: [August 4, 2017, 7:07pm UTC](https://discuss.elastic.co/t/logging-into-kibana-from-a-react-page-using-api-security-v1-login/95018/6 "2017-08-04T19:07:14Z")
> [@weltenwort](#):
>
> fetch("[https://HOSTNAME/api/security/v1/login](https://HOSTNAME/api/security/v1/login)", {
> body: JSON.stringify({
> username: "USERNAME",
> password:"PASSWORD",
> }),
> credentials: 'include',
> headers: {
> "kbn-version": "5.5.1",
> },
> method: "POST",
> })
It worked! Thanks so much
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2017, 7:07pm UTC](https://discuss.elastic.co/t/logging-into-kibana-from-a-react-page-using-api-security-v1-login/95018/7 "2017-09-01T19:07:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.