# Dashboard token authentication

**URL:** <https://discourse.nodered.org/t/dashboard-token-authentication/74692>\
**Category:** Dashboard\
**Tags:** node-red-dashboard, security\
**Created:** [4 February 2023 12:34 UTC](https://discourse.nodered.org/t/dashboard-token-authentication/74692 "2023-02-04T12:34:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dth](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dth/32/72723_2.png) [@dth](https://discourse.nodered.org/u/dth)\
**Post date:** [4 February 2023 12:34 UTC](https://discourse.nodered.org/t/dashboard-token-authentication/74692/1 "2023-02-04T12:34:46Z")

</div>

Is there a way to implement entirely custom authentication for the dashboard? I found this:

[https://discourse.nodered.org/t/remember-me-for-node-red-dashboard/40677](https://discourse.nodered.org/t/remember-me-for-node-red-dashboard/40677)

But is unclear if the HTTP request parameters can be accessed here, so for example a simple token (pre shared key) authentication could be implemented.

It is needed to make it possible for iPhone "web app on home screen" to work properly. Regular Basic Authentication is not remembered (neither the login session nor the username/password), so it must be typed in very, very often.

Any pointers are very welcome 🙂

---

<div class="post-metadata">

**Author:** ![kevinGodell](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/kevingodell/32/27040_2.png) [@kevinGodell](https://discourse.nodered.org/u/kevinGodell)\
**Post date:** [4 February 2023 19:19 UTC](https://discourse.nodered.org/t/dashboard-token-authentication/74692/2 "2023-02-04T19:19:51Z")

</div>

> [@dth](#):
>
> It is needed to make it possible for iPhone "web app on home screen" to work properly

Yes, that is a problem and I have also experienced that exact issue. I blame apple. 😅

You can create your own authentication system and insert the relevant middleware in the settings.js file at the sections that make reference to middleware. Of course, you will have to turn off the built-in httpNodeAuth to do this.

Personally, I have done this for myself and kept it private due to it probably lacking adequate security. If you don't need multiple users with various access levels, then you may be able to run a proxy in front of your node-red and do the authentication there. I have no idea how that works, but it has been suggested many times in the forum as a safer option.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [6 March 2023 19:20 UTC](https://discourse.nodered.org/t/dashboard-token-authentication/74692/3 "2023-03-06T19:20:11Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.