# Authentication with cookies to log who has pressed a certain button

**URL:** <https://discourse.nodered.org/t/authentication-with-cookies-to-log-who-has-pressed-a-certain-button/65483>\
**Category:** General\
**Created:** [22 July 2022 13:40 UTC](https://discourse.nodered.org/t/authentication-with-cookies-to-log-who-has-pressed-a-certain-button/65483 "2022-07-22T13:40:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Giu-seppe](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/giu-seppe/32/40489_2.png) [@Giu-seppe](https://discourse.nodered.org/u/Giu-seppe)\
**Post date:** [22 July 2022 13:40 UTC](https://discourse.nodered.org/t/authentication-with-cookies-to-log-who-has-pressed-a-certain-button/65483/1 "2022-07-22T13:40:34Z")

</div>

hi guys,  
I am trying to implement a new feature in my application.  
I would need to understand, among a list of users, which user has pressed a certain button within the dashboard and log it.  
I don't need the feature to be highly cyber secure.  
I was thinking of disabling the nav. tab and change page only if authentication is successful.

To do this I was thinking of using two possible options:  
1 Socket ID  
2 Cookies

1 Socket ID  
Save the socketID when a user "log in" and use it to understand who press the button.  
Then take the socketId property of each message and figure out who it is associated with  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/4/e/4eacf8e3329d34a064a3d421174200103f631df4.png)  
But it is really too easy for a user to change their socketId via URL even by mistake.  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/d/d/ddc9e7a00096fa3c132208a264bdc8a3dfba41f7.png)

Moreover, I don't know if there could be other complications, such as socket id changing by reloading the page or for other reasons. Also, I don't know if there could be other complications, such as socket id changing by reloading the page or for other reasons.  
Also, I don't know if there could be other complications, such as socket id changing by reloading the page or for other reasons.  
I wait for illuminations from a more experienced person

2 Cookies  
More professional but also more complicated.  
At the moment I am trying to use this flow found on the net ([Cookie based Auth](https://flows.nodered.org/flow/5a0614db288deab2acb408d4bdcc9db0) ) but I have some errors like this

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/1/e/1e8027b297457c6c3791a6d78fefd2e15f56c58a.png)

Do you have any suggestions? are there any tips and tricks to develop it better?  
I'm sure the community has many ideas and implementations on this.

node red version 1.3.5  
node.js 12.18.3

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [22 July 2022 16:20 UTC](https://discourse.nodered.org/t/authentication-with-cookies-to-log-who-has-pressed-a-certain-button/65483/2 "2022-07-22T16:20:16Z")

</div>

> [@Giu-seppe](#):
>
> 1 Socket ID

that changes if a user reloads the page or the browser temporarily looses connection (eg device goes into power saving).

> [@Giu-seppe](#):
>
> node.js 12.18.3

That version is no longer supported.

> [@Giu-seppe](#):
>
> this flow found on the net

is quite specific and i'm not sure how well it adapts.

Possibly the easiest approach (though certainly not at all "secure") would be to get your authentication to send a client id to the client and get the the Dashboard to save it to persistent storage and then include it when you send something back to node-red. However, this would mean that you couldn't use any of the Dashboard nodes. In that case, you would be better off using uibuilder which already has a persistent client id baked in (is destroyed when the whole browser closes).

---

<div class="post-metadata">

**Author:** ![HaroldPetersInskipp](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/haroldpetersinskipp/32/42319_2.png) [@HaroldPetersInskipp](https://discourse.nodered.org/u/HaroldPetersInskipp)\
**Post date:** [22 July 2022 16:59 UTC](https://discourse.nodered.org/t/authentication-with-cookies-to-log-who-has-pressed-a-certain-button/65483/3 "2022-07-22T16:59:01Z")

</div>

Looks like you need to require the `crypto` module in the function node.

 ![](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/0/5/05d48dcd42379595dabce82be7964bf6a4c68955.png)

---

<div class="post-metadata">

**Author:** ![Giu-seppe](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/giu-seppe/32/40489_2.png) [@Giu-seppe](https://discourse.nodered.org/u/Giu-seppe)\
**Post date:** [25 July 2022 12:45 UTC](https://discourse.nodered.org/t/authentication-with-cookies-to-log-who-has-pressed-a-certain-button/65483/4 "2022-07-25T12:45:22Z")

</div>

Thanks for the reply.  
Isn't there a way to do this while still using the node-red-dashboard?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [25 July 2022 19:56 UTC](https://discourse.nodered.org/t/authentication-with-cookies-to-log-who-has-pressed-a-certain-button/65483/5 "2022-07-25T19:56:37Z")

</div>

> [@Giu-seppe](#):
>
> Isn't there a way to do this while still using the node-red-dashboard?

Possibly someone else may know but I'm afraid I don't as I don't use Dashboard except for quick experiments.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [23 September 2022 19:57 UTC](https://discourse.nodered.org/t/authentication-with-cookies-to-log-who-has-pressed-a-certain-button/65483/6 "2022-09-23T19:57:26Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.