# Using tokens with the endpoint /internal/security/login for logging instead of basic authentication

**URL:** <https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [December 30, 2020, 6:55pm UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909 "2020-12-30T18:55:30Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![azasypkin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azasypkin/32/42216_2.png) [@azasypkin](https://discuss.elastic.co/u/azasypkin)\
**Post date:** [December 31, 2020, 12:22pm UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909/4 "2020-12-31T12:22:47Z")

</div>

> [@DMinovski](#):
>
> I'm loading dashboards in iFrames. The verification works, but the username and password are available in the HTML code. Using tokens, if possible, will improve security.

The fact that _it won't improve_ security, since you'll still have token in this HTML and it's pretty much the same. Not to mention that token is valid for max 1 hour. But why aren't you using [usual proxy setup](https://discuss.elastic.co/t/auto-authenticating-to-iframe-embedded-kibana-dashboard/46091/4) that just stores credentials on the reverse proxy side and credentials are never exposed to the end user?

Also since 7.11 you'll be able to use [anonymous access](https://www.elastic.co/guide/en/kibana/7.11/kibana-authentication.html#anonymous-authentication) instead of Kibana + reverse proxy.

Best,  
Oleg

---

_[View the full topic](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909)._