Forum Discussion
Embedding Power BI Report Server reports with iframe - is it safe?
Super Useriframes will not give your users a seamless authentication experience and will not allow your hosting application to transfer context over (you can mitigate that somewhat with report URL filters.
The standard way would be to use full Power BI embedded (in your case "user owns data") but I don't how how that applies to PBIRS.
Power BI embedded analytics overview - Power BI | Microsoft Learn
Thanks for answer!
Both PBIRS and the web application we implelemnt the iframe from are internal systems, and will not communicate outside the organisation. It seems like the authentication works fine with iframe and PBIRS..
- d_gosbell
Using iframes are the only option with PBIRS, it does not support the same embedding options as the cloud service. I think that one of the big concerns with iframes are XSS attacks, but since PBIRS does not store and render unvalidated user data I *think* the attack vectors are limited there. For example I am not aware of any way that a user could enter javascript into a report parameter and have that execute so that it could do malicious things on the host site.
