Power BI Configuration Visible to End Users

Question

We are using Power BI API to embed reports into our asp.net core MVC application using Power BI Javascript Library. We would have only one master user which will have a Power BI account and we would be using its credentials to get reports for all users who log in. The reports will also have filters which can be applied by the users from the UI and also a default filter will be applied while embedding report based on user's permissions. We are trying to filter reports using Javascript API as suggested here : PowerBI Reports Filter Using Javascript API and we are following PowerBI Embedded Reports Demo from microsoft to embed the report in our view. But the problem is that all the configuration including access token and filters are visible in developer tools of browser as shown below :

Now the filters provided to users on UI are restricted based on their roles and permissions so they can only apply certain filters to report and are shown only a filtered report data but if the access token and filters are clearly visible in developer tools , they can remove filters and use any tool for e.g postman and view the full report which is not desired. We do understand this problem arises because we are using only one PowerBI master account but we can not provide all users a PowerBI subscription. So, is there a way we can

• Apply configurations, filters and generate PowerBI Report on Server Side and then return the svg generated to View similar to angular server side rendering?

Or is there any other way to send parameters from server to PowerBI using PowerBIClient class and filter reports at power bi end ?

Answer 1

Report filters are not a security feature. You should try this approach: https://docs.microsoft.com/en-us/power-bi/developer/embedded-row-level-security

Answer 2

After trying everything, we were still not able to achieve full security but we were able to change embed url by adding parameters as query string on server side instead of using filter at client side. We followed this msdn article to achieve that : PowerBI API Query String Filters MSDN

Although, that is still not full proof because once server returns embed url with parameters to browser, then browser has to make final request to power bi saas service which can be easily seen in browser network tab or using fiddler but we have avoided filters being easily seen in html script sections. Let us know if anybody has better solution with respect to this problem.