# Dashboard protection

**URL:** https://discourse.nodered.org/t/dashboard-protection/7559
**Category:** Dashboard
**Created:** [4 February 2019 07:34 UTC](https://discourse.nodered.org/t/dashboard-protection/7559 "2019-02-04T07:34:49Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![XYZ](https://avatars.discourse-cdn.com/v4/letter/x/b5a626/32.png) [@XYZ](https://discourse.nodered.org/u/XYZ)
#### Post date: [4 February 2019 07:34 UTC](https://discourse.nodered.org/t/dashboard-protection/7559/1 "2019-02-04T07:34:49Z")

</div>

How can we protect the dashboard UI for NodeRED as it still blocks http in requests as well.

---

<div class="post-metadata">

### Author: ![realjax](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/realjax/32/895_2.png) [@realjax](https://discourse.nodered.org/u/realjax)
#### Post date: [4 February 2019 07:53 UTC](https://discourse.nodered.org/t/dashboard-protection/7559/2 "2019-02-04T07:53:35Z")

</div>

Not sure what you mean here. Does you dashboard block incoming requests?

---

<div class="post-metadata">

### Author: ![XYZ](https://avatars.discourse-cdn.com/v4/letter/x/b5a626/32.png) [@XYZ](https://discourse.nodered.org/u/XYZ)
#### Post date: [4 February 2019 08:21 UTC](https://discourse.nodered.org/t/dashboard-protection/7559/3 "2019-02-04T08:21:58Z")

</div>

As we set up the nodeAuth it blocks the http in requests as well. It asks for the user and password for the Http in as well.

---

<div class="post-metadata">

### Author: ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [4 February 2019 08:58 UTC](https://discourse.nodered.org/t/dashboard-protection/7559/4 "2019-02-04T08:58:09Z")

</div>

Yes - currently the dashboard is "just another" http endpoint so is protected by the same (and only) mechanism - so if you turn it on for one you turn it on for the whole application.

---

<div class="post-metadata">

### Author: ![XYZ](https://avatars.discourse-cdn.com/v4/letter/x/b5a626/32.png) [@XYZ](https://discourse.nodered.org/u/XYZ)
#### Post date: [4 February 2019 09:07 UTC](https://discourse.nodered.org/t/dashboard-protection/7559/5 "2019-02-04T09:07:14Z")

</div>

so what could be the solution for this ?

---

<div class="post-metadata">

### Author: ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [4 February 2019 09:23 UTC](https://discourse.nodered.org/t/dashboard-protection/7559/6 "2019-02-04T09:23:28Z")

</div>

> [@dceejay](#):
>
> Yes - currently the dashboard is "just another" http endpoint so is protected by the same (and only) mechanism - so if you turn it on for one you turn it on for the whole application.

And also for uibuilder 🙂 I might need to add a flag to make that optional perhaps?