Forum Discussion

jakob82's avatar
jakob82
Frequent Visitor
3 years ago

Embedding Power BI Report Server reports with iframe - is it safe?

Hi

 

I wonder if it is recommended to use iframe when embedding reports from Power BI Report Server to our Blazor WASM application? I have always heard that you should avoid using iframes, but from what i understand, iframes are the only alternative? What are the guidelines? Is it possible to refer to some Microsoft documentation that says it is secure?

 

Thanks 

iframe
Report Server
security

3 Replies

  • lbendlin's avatar
    lbendlin
    Super User
    3 years ago

    iframes will not give your users a seamless authentication experience and will not allow your hosting application to transfer context over (you can mitigate that somewhat with report URL filters.

     

    The standard way would be to use full Power BI embedded (in your  case "user owns data") but I don't how how that applies to PBIRS.

     

    Power BI embedded analytics overview - Power BI | Microsoft Learn

    • jakob82's avatar
      jakob82
      Frequent Visitor
      3 years ago

      Thanks for answer!

       

      Both PBIRS and the web application we implelemnt the iframe from are internal systems, and will not communicate outside the organisation. It seems like the authentication works fine with iframe and PBIRS.. 

      • d_gosbell's avatar
        d_gosbell
        Super User
        3 years ago

        Using iframes are the only option with PBIRS, it does not support the same embedding options as the cloud service. I think that one of the big concerns with iframes are XSS attacks, but since PBIRS does not store and render unvalidated user data I *think* the attack vectors are limited there. For example I am not aware of any way that a user could enter javascript into a report parameter and have that execute so that it could do malicious things on the host site.