How to bypass Power BI JavaScript Library to embed Power BI content

[sureshrm]

I am using PowerBI Embeded application and it is working fine. I am using Power BI JavaScript library to embed Power BI content. But this eposes security concern as accessToken , embedUrl , embedReportId are exposed.  Is their any way i can bypass / secure this content 

Thanks in advance.

[sureshrm]

Hi All,

I am working on an Application to embed PowerBI reports using App only data. The soultion is working fine and able to render the report. Now the problem is if i select View Source poperty then i can see powerbi javascript code whch exposes some of the key values like embedUrl, embedReportId and accessToken. This is a security risk . How can i pervent this ? Any help would be deeply appriciated.

[TedPattison]

You will not be able to hide those elements because they muist be sent to the browser. The access token and embed url must be sent to the browser because of the core architecture of Power BI embedding which loads Power BI embedded resources using an iFrame.  This is something that cannot be done using server-side code. 

If you are using third-party embedding (app-owns-data), then you should not be sending Azure AD access tokens back to the browser. Instead, you generate embed tokens using the Power BI Service which are far ore constrained because any embed token only works with a single report or dashboard. Compare that to an Azure AD access token which gives a potential attacker a much broader set permissions across the Power BI environment.

[sureshrm]

Thanks for the suggestions. 

Just to make sure i define my requirement correct [ My requirement is app own data]

1) Used the sample MVC app provided by Microsoft . 

2) Customized to my requirement . Kept embed token generation logic and removed rest all

3) Use all the scripts provided inside sample application.

On execution of application i am getting report embed with view source is showing values of 

1) ReportID

2) AccessToken [ Actually it is embed token . In script the variable name is access token]

3) EmbedURL 

If  i get your suggestions correctly then 

1) These values are must for browser and they are part of PowerBI Embed architecture

2) The exposed values combination [ReprotID , AccessToken, EmbedURL] are for one specific report . So if i change the values of ReportID or EmbedURL then it  wont wok .

3) Is it possible to set the life time of embedURL to 'N' minutes ? So that user will be forced to use new token. 

Also you had suggested to generate generate embed tokens using the Power BI Service . I am not sure what you meant by this . In my application i am using PowerBI REST API. If i am missing any then can you help me with some pointer / link 

Thanks a lot once again.

[TedPattison · Accepted solution]

First of all, we are talking about the same thing using different names. The "thing" is the API endpoint at https://api.powerbi.com/v1.0/. Here are the different names people use for this

1. Power BI REST API
2. Power BI API
3. Power BI Service API (the one I like)

Just to confirm these values are must for browser and they are part of PowerBI Embed architecture

YES

The exposed values combination [ReprotID , AccessToken, EmbedURL] are for one specific report . So if i change the values of ReportID or EmbedURL then it  wont wok .

YES, as long as they are embed tokens and not Azure AD access tokens.

Is it possible to set the life time of embedURL to 'N' minutes ? So that user will be forced to use new token. 

NO, the embedUrl points to a resource. It's the embed token that provides access to the resource. The Power BI embed token lifetime is about 60 minutes but I do not think that is something you could change. 

[sureshrm]

Hi Ted

Thanks for the swift reply. 

THanks,

Suresh RM