Blog
OpenSearch Dashboards behind nginx: CORS, reverse proxies, and securing analytics UIs
Dashboards issue browser requests to the same host when proxied; misconfigured CORS often means mixed content or wrong Host headers.
1 min read
opensearchelasticsearchcors
Authentication
SAML and OIDC flows may open popups—ensure redirect URIs align with your public dashboard URL.
Fine-grained security indices still need CORS only for browser-based dev tools, not server queries.
Multi-tenancy
Separate dashboards per tenant with distinct subdomains to simplify Allow-Origin rules.
Avoid wildcard TLS certificates that encourage overly broad CORS patterns.