Secure Elasticsearch access via browser

Edit: After chatting, your issue turned out to be that you didn't want to expose ES to the outside world, only to your app. The solution was the bind ES to the local interface by setting:

network.host: 127.0.0.1

Previous answer:

Typically, you would run nginx (or another webserver) which performs basic authentication, and then proxy requests to Elasticsearch.

This is a stripped down config which may help you. Consider using SSL/TLS for your server, since BasicAuth passwords are sent in the clear otherwise.

server {
  listen 80 default_server;
  server_name your.server.address.com;
  client_max_body_size 50M;

  location / {
    # Pass requests to ElasticSearch
    proxy_pass http://localhost:9200;
    proxy_redirect off;

    proxy_set_header  X-Real-IP  $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header  Host $http_host;

    # For CORS Ajax
    proxy_pass_header Access-Control-Allow-Origin;
    proxy_pass_header Access-Control-Allow-Methods;
    proxy_hide_header Access-Control-Allow-Headers;
    add_header Access-Control-Allow-Headers 'X-Requested-With, Content-Type';
    add_header Access-Control-Allow-Credentials true;

    # Authorize access
    auth_basic           "ElasticSearch";
    auth_basic_user_file /etc/elasticsearch/passwords;
  }
}