Custom visuals and data security

JSJB — Fri, 16 Jun 2023 11:16:54 GMT

Hello,

I am working on a visual that allows the user to query some external data sources. This includes an API and a database.

Part of doing this is allowing users to specify their own addresses for both. A concern we have, however, is that we are unsure to what degree certain data is accessible to the end-user via the browser console.

Right now, we are planning to receive the sensitive data via the Visual settings panel. This settings panel, naturally, is only accessible to report developers. A concern we have, however, is to what extent this data is accessible to anyone with a browser console and enough tenacity.

So, some questions:

1. To what extent is it possible to access Custom Viz variables via the browser console? (even if unlikely)

2. Does the PBI API (or something else) offer a form of environment variables that can both give critical information to the app while not being exposed to any users?

3. Does the PBI API have any kind of handling for sensitive data such as logins? I know of a number of workarounds, but they are all workarounds and not super ideal. Is there any "native" handling? I can't find documentation on this.

4. Since PBI sandboxes the custom visuals, are there certain security measures directly implemented? (E.g. perhaps vars are already treated as being from .env?)

I understand this may be a bit of a niche and annoying set of questions. But I've scoured through the documentation and forums, and I can't really find any concrete information on these. These features are unfortunately absolutely essential for the functionality of the app.

Thank you all very much

topic Custom visuals and data security in Custom Visuals Development Discussion

Custom visuals and data security