How Embedding Power BI report in custom application is secured?

[daxesh]

Hello 

I am embedding Power BI report in web application using Power BI rest Apis

Refedrred this link :

https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-integrate-report/

Getting a access token from auth2 grant flow seems secure as it had been implemented on server side using C# code.

But when report needs to be embed in iframe i had to fetch reportid , embedurl and accesstoken on javascript side while performing postMessage() on iframe. 

If it needs to be done on client side , How is it secure to embed report this way ?

Please explain.

Another thing i need to ask is regarding Power BI - Javascript APis.

This way of embedding the same way that reportid , accesstoken and embedurl needs to be configure in configration settings

Please refer documentation 

https://github.com/Microsoft/PowerBI-JavaScript/wiki/Embed-Configuration-Details

Then how is it secure if it is on client side.

Thanks in advance

[Eric_Zhang · Accepted solution]

@daxesh

You could see the accesstoken in client end either via postMessage or via Javascript API. By default the accesstoken would expire in one hour.

As to the security concern, when embedding a report via the REST API, before the access token is generated, it actually requires you to login in a pop-up window, you'll have to type your account and password.