What's the most secure way to expose access through Home Assistant frontend?

[barndawgie]

My preferred way to access the Z-Wave JS UI is as an iFrame embed in the HASS UI. I'd like to expose that outside of my home network but have been hesitant to do so as I can't figure out a good way without making the Z-Wave JS UI public on the internet, and Z-Wave JS UI auth didn't seem to behave very well in the iFrame model.

Is there a "right" way to do this that provides a reasonable experience in the app or web?

[robertsLando]

Why the embedded auth doesn't behave well in the iframe?

[barndawgie]

I was having an issue where it wanted me to re-auth on every page reload, but that has passed...maybe putting it on the same domain fixed that...

[robertsLando]

The alternative would be to add a basic auth using nginx proxy: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/