# Security using Elasticsearch and X-pack in Angular 2/5

**URL:** <https://discuss.elastic.co/t/security-using-elasticsearch-and-x-pack-in-angular-2-5/109990>\
**Category:** Elasticsearch\
**Created:** [December 2, 2017, 12:28am UTC](https://discuss.elastic.co/t/security-using-elasticsearch-and-x-pack-in-angular-2-5/109990 "2017-12-02T00:28:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bradley](https://avatars.discourse-cdn.com/v4/letter/b/c37758/32.png) [@bradley](https://discuss.elastic.co/u/bradley)\
**Post date:** [December 2, 2017, 12:28am UTC](https://discuss.elastic.co/t/security-using-elasticsearch-and-x-pack-in-angular-2-5/109990/1 "2017-12-02T00:28:33Z")

</div>

I have posted this [question](https://stackoverflow.com/questions/47603266/) to Stack Overflow to gather information about how to plan my application around security. The main question is how to leverage Elasticsearch and X-pack to hide part of my application from the public.

> <https://stackoverflow.com/questions/47603266/security-using-elasticsearch-and-x-pack-in-angular-2-5>

---

<div class="post-metadata">

**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\
**Post date:** [December 6, 2017, 9:34am UTC](https://discuss.elastic.co/t/security-using-elasticsearch-and-x-pack-in-angular-2-5/109990/2 "2017-12-06T09:34:47Z")

</div>

Hi @bradley,

if Elasticsearch is the main datastore of your application, you could use x-pack security user accounts for login. That way you could selectively grant access to portions of the data using index-level security and document-level security without maintaining an additional mapping between two authentication systems.

While this protects the data stored in Elasticsearch, it will not protect the client-side part of your source code. This would require you to split the client-side bundle into a public and a private bundle with the public bundle containing the login logic and the private bundle the rest of your application. The private bundle would have to be protected from being loaded without a login by a server-side application.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 3, 2018, 9:34am UTC](https://discuss.elastic.co/t/security-using-elasticsearch-and-x-pack-in-angular-2-5/109990/3 "2018-01-03T09:34:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.