# Block env.get in function node

**URL:** <https://discourse.nodered.org/t/block-env-get-in-function-node/28872>\
**Category:** General\
**Created:** [24 June 2020 08:45 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872 "2020-06-24T08:45:42Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![edoardottt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edoardottt/32/20179_2.png) [@edoardottt](https://discourse.nodered.org/u/edoardottt)\
**Post date:** [24 June 2020 08:45 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/1 "2020-06-24T08:45:42Z")

</div>

Hi. I use node-red in a shared system, so others users can access the editor. I don't want to exclude from the editor the function node.  
But I saw that, if I know the environment variables name, I can print them on debug console.  
These env. Vars. Contain sensitive informations. **Is there a way to block the env.get functionality?**  
Or I have to exclude the node from the editor?  
_ **All the ideas are welcome, thanks** _ 🙂

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [24 June 2020 10:11 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/2 "2020-06-24T10:11:33Z")

</div>

You can also access environment variables through a number of other nodes, such as the Change node and Inject node. It is best not to put sensitive information in env variables. node-red-contrib-credentials might be useful to you instead.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [24 June 2020 10:20 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/3 "2020-06-24T10:20:28Z")

</div>

> [@Colin](#):
>
> You can also access environment variables through a number of other nodes, such as the Change node and Inject node

Whilst that is true, it is also true to say that Node-RED is in complete control as to what is allowed to be accessed or not, so it would be feasible to add some sort of allow/deny list in settings.js.

But it also depends on the specific requirements.

If they are env vars that are set in the environment, but otherwise unused by Node-RED, then you could clear them in your settings.js file to prevent the runtime from being able to see them:

```auto
process.env.secret = "";

```

If they are env vars that you use in node configurations, then it is a harder problem - how do we identify when its a valid use of the env var versus an invalid use?

---

<div class="post-metadata">

**Author:** ![edoardottt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edoardottt/32/20179_2.png) [@edoardottt](https://discourse.nodered.org/u/edoardottt)\
**Post date:** [24 June 2020 10:25 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/4 "2020-06-24T10:25:35Z")

</div>

Thanks. I figured out that I can print on debug console just with an inject node. damn.

---

<div class="post-metadata">

**Author:** ![edoardottt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edoardottt/32/20179_2.png) [@edoardottt](https://discourse.nodered.org/u/edoardottt)\
**Post date:** [24 June 2020 10:29 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/5 "2020-06-24T10:29:23Z")

</div>

Yes, they are env vars used by Node-RED. I use them into some custom nodes.

Is there a way to use them only in custom nodes but not shown in debug console?

I use them to set docker container parameters.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [24 June 2020 10:42 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/6 "2020-06-24T10:42:59Z")

</div>

Would the contrib node I suggested help or do you need to set them outside of node red? I suspect it is possible to add items to the credentials outside of node red but not sure how.

---

<div class="post-metadata">

**Author:** ![edoardottt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edoardottt/32/20179_2.png) [@edoardottt](https://discourse.nodered.org/u/edoardottt)\
**Post date:** [24 June 2020 10:52 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/7 "2020-06-24T10:52:09Z")

</div>

No, unfortunately it isn't useful.. I have to configure docker instances with these env vars, so I can't 'hide' them in the frontend flow. It's a backend problem..

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [24 June 2020 13:40 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/8 "2020-06-24T13:40:40Z")

</div>

I think that Nicks suggestion of overwriting them in settings.js is likely to be the best bet if that works. Or running Node-RED from within its own shell environment (or from systemd) where those Docker variables wouldn't be visible.

The only other alternative that I can think of would be to overwrite the `process.env` function in Node.js but I suspect that would break other things.

Despite what many web tutorials would have you believe, environment variables are not secure and shouldn't be used for sensitive data. Particularly when you are then making an entire development platform (Node-RED) and server development service (node.js) available to end users.

---

<div class="post-metadata">

**Author:** ![edoardottt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edoardottt/32/20179_2.png) [@edoardottt](https://discourse.nodered.org/u/edoardottt)\
**Post date:** [24 June 2020 13:46 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/9 "2020-06-24T13:46:08Z")

</div>

That can't work because I use them to configure a docker instance running Node-RED.  
And I use those vars in a lot of custom nodes ☹ So I can't just overwrite them.  
I have to change something in the architecture I think..

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [24 June 2020 15:26 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/10 "2020-06-24T15:26:14Z")

</div>

In your settings.js, transfer the env variables to something else - you can add properties to the settings that are only accessible from custom nodes I believe.

Once you've transferred them, blank them.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [23 August 2020 15:26 UTC](https://discourse.nodered.org/t/block-env-get-in-function-node/28872/11 "2020-08-23T15:26:32Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.