# Unable to perform login on kibana throught browser javascript api call **URL:** \ **Category:** Kibana\ **Tags:** elastic-stack-security\ **Created:** [July 8, 2019, 12:36pm UTC](https://discuss.elastic.co/t/unable-to-perform-login-on-kibana-throught-browser-javascript-api-call/189345 "2019-07-08T12:36:28Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![RafaelZurlo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafaelzurlo/32/49609_2.png) [@RafaelZurlo](https://discuss.elastic.co/u/RafaelZurlo)\ **Post date:** [July 8, 2019, 12:36pm UTC](https://discuss.elastic.co/t/unable-to-perform-login-on-kibana-throught-browser-javascript-api-call/189345/1 "2019-07-08T12:36:28Z")
We are trying without success to call the kibana (Elastic Cloud) login api api/security/v1/login on the browser with javascript. The code is $.ajax({ method: "POST", url: "[https://XXXXXXXXXXXXXXXXXXX:9243/api/security/v1/login](https://XXXXXXXXXXXXXXXXXXX:9243/api/security/v1/login)", dataType: "json", headers: { "kbn-xsrf": "6.6.2", 'Content-Type': 'application/json'}, data: { "username": 'user', "password": '123456' }, success: function (success) { console.log("ok"); }, error: function (error) { console.log("error"); } }); The error returned on browser is Access to XMLHttpRequest at '[https://XXXXXXXXXXXXXXXXXXXXXXXX:9243/api/security/v1/login](https://XXXXXXXXXXXXXXXXXXXXXXXX:9243/api/security/v1/login)' from origin '[http://localhost:4000](http://localhost:4000)' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. Does anyone knows how to solve this problem? ---
**Author:** ![joshdover](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshdover/32/42020_2.png) [@joshdover](https://discuss.elastic.co/u/joshdover)\ **Post date:** [July 8, 2019, 2:08pm UTC](https://discuss.elastic.co/t/unable-to-perform-login-on-kibana-throught-browser-javascript-api-call/189345/2 "2019-07-08T14:08:08Z")
Hi there! In order to make requests across domains inside a browser, you'll need to enable CORS on the Kibana server. Unfortunately, this is not a documented configuration option, but it is supported. Add `server.cors: true` to your kibana.yml in the Cloud dashboard. This should add the `Access-Control-Allow-Origin: *` header to all responses from Kibana. Note that this enables _any_ webpage to access your Kibana API, though of course they'll still need valid credentials if you're using Security. ---
**Author:** ![RafaelZurlo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafaelzurlo/32/49609_2.png) [@RafaelZurlo](https://discuss.elastic.co/u/RafaelZurlo)\ **Post date:** [July 8, 2019, 2:25pm UTC](https://discuss.elastic.co/t/unable-to-perform-login-on-kibana-throught-browser-javascript-api-call/189345/3 "2019-07-08T14:25:09Z")
We tried to set this configuration server.cors: true to our kibana.yml on the elastic cloud deployment but the Activity page shows the following error: 'server.cors': is not allowed Please, what are we doing wrong? ---
**Author:** ![joshdover](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshdover/32/42020_2.png) [@joshdover](https://discuss.elastic.co/u/joshdover)\ **Post date:** [July 8, 2019, 2:39pm UTC](https://discuss.elastic.co/t/unable-to-perform-login-on-kibana-throught-browser-javascript-api-call/189345/4 "2019-07-08T14:39:57Z")
It looks like we disallow this option in Elastic Cloud. Reach out to Cloud Support, they may be able to enable this setting for you. If not, you will need to set up a proxy server (eg. nginx) in front of your Kibana server to add these headers. Though before doing that, you may want to explore other options. What is it that you're trying to develop? ---
**Author:** ![RafaelZurlo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rafaelzurlo/32/49609_2.png) [@RafaelZurlo](https://discuss.elastic.co/u/RafaelZurlo)\ **Post date:** [July 8, 2019, 2:44pm UTC](https://discuss.elastic.co/t/unable-to-perform-login-on-kibana-throught-browser-javascript-api-call/189345/5 "2019-07-08T14:44:16Z")
> [@joshdover](#): > > nginx Hello Josh, We want to show the kibana dashboard on a elixir/phoenix aplication of ours. The dashboard will be shown on a iframe tag. Ok, we will try some more to set the the server.cors option, and reach out the cloud support if necessary. Thank you very much. ---
**Author:** ![joshdover](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshdover/32/42020_2.png) [@joshdover](https://discuss.elastic.co/u/joshdover)\ **Post date:** [July 8, 2019, 3:00pm UTC](https://discuss.elastic.co/t/unable-to-perform-login-on-kibana-throught-browser-javascript-api-call/189345/6 "2019-07-08T15:00:45Z")
Got it! This [thread here](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091) may be helpful. You can setup a nginx server that adds Authorization headers for a specific user to auto-authenticate requests. This is likely more secure than embedding credentials in your client-side code. If this a public-facing site, I definitely recommend using credentials for a user with the `kibana_dashboard_only_user` role so they cannot modify any Kibana data. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 5, 2019, 3:00pm UTC](https://discuss.elastic.co/t/unable-to-perform-login-on-kibana-throught-browser-javascript-api-call/189345/7 "2019-08-05T15:00:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.