topic Re: How to hide embedUrl and AccessToken from Javascript in PowerBIEmbedded in Developer

How to bypass Power BI JavaScript Library to embed Power BI content

sureshrm — Thu, 11 Oct 2018 14:23:32 GMT

I am using PowerBI Embeded application and it is working fine. I am using Power BI JavaScript library to embed Power BI content. But this eposes security concern as accessToken , embedUrl , embedReportId are exposed. Is their any way i can bypass / secure this content

Thanks in advance.

How to hide embedUrl and AccessToken from Javascript in PowerBIEmbedded

sureshrm — Thu, 11 Oct 2018 11:25:55 GMT

Hi All,

I am working on an Application to embed PowerBI reports using App only data. The soultion is working fine and able to render the report. Now the problem is if i select View Source poperty then i can see powerbi javascript code whch exposes some of the key values like embedUrl, embedReportId and accessToken. This is a security risk . How can i pervent this ? Any help would be deeply appriciated.

Re: How to hide embedUrl and AccessToken from Javascript in PowerBIEmbedded

TedPattison — Fri, 12 Oct 2018 17:36:36 GMT

You will not be able to hide those elements because they muist be sent to the browser. The access token and embed url must be sent to the browser because of the core architecture of Power BI embedding which loads Power BI embedded resources using an iFrame. This is something that cannot be done using server-side code.

If you are using third-party embedding (app-owns-data), then you should not be sending Azure AD access tokens back to the browser. Instead, you generate embed tokens using the Power BI Service which are far ore constrained because any embed token only works with a single report or dashboard. Compare that to an Azure AD access token which gives a potential attacker a much broader set permissions across the Power BI environment.

Re: How to hide embedUrl and AccessToken from Javascript in PowerBIEmbedded

sureshrm — Sat, 13 Oct 2018 17:50:00 GMT

Thanks for the suggestions.

Just to make sure i define my requirement correct [ My requirement is app own data]

1) Used the sample MVC app provided by Microsoft .

2) Customized to my requirement . Kept embed token generation logic and removed rest all

3) Use all the scripts provided inside sample application.

On execution of application i am getting report embed with view source is showing values of

1) ReportID

2) AccessToken [ Actually it is embed token . In script the variable name is access token]

3) EmbedURL

If i get your suggestions correctly then

1) These values are must for browser and they are part of PowerBI Embed architecture

2) The exposed values combination [ReprotID , AccessToken, EmbedURL] are for one specific report . So if i change the values of ReportID or EmbedURL then it wont wok .

3) Is it possible to set the life time of embedURL to 'N' minutes ? So that user will be forced to use new token.

Also you had suggested to generate generate embed tokens using the Power BI Service . I am not sure what you meant by this . In my application i am using PowerBI REST API. If i am missing any then can you help me with some pointer / link

Thanks a lot once again.

Re: How to hide embedUrl and AccessToken from Javascript in PowerBIEmbedded

TedPattison — Sat, 13 Oct 2018 19:09:19 GMT

First of all, we are talking about the same thing using different names. The "thing" is the API endpoint at https://api.powerbi.com/v1.0/. Here are the different names people use for this

Power BI REST API
Power BI API
Power BI Service API (the one I like)

Just to confirm these values are must for browser and they are part of PowerBI Embed architecture

YES

The exposed values combination [ReprotID , AccessToken, EmbedURL] are for one specific report . So if i change the values of ReportID or EmbedURL then it wont wok .

YES, as long as they are embed tokens and not Azure AD access tokens.

Is it possible to set the life time of embedURL to 'N' minutes ? So that user will be forced to use new token.

NO, the embedUrl points to a resource. It's the embed token that provides access to the resource. The Power BI embed token lifetime is about 60 minutes but I do not think that is something you could change.

Re: How to hide embedUrl and AccessToken from Javascript in PowerBIEmbedded

sureshrm — Sat, 13 Oct 2018 19:36:21 GMT

Hi Ted

Thanks for the swift reply.

THanks,

Suresh RM