# Disable access to ENV vars

**URL:** <https://discourse.nodered.org/t/disable-access-to-env-vars/48589>\
**Category:** Core Development\
**Created:** [19 July 2021 12:41 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589 "2021-07-19T12:41:17Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bulduper](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bulduper/32/47322_2.png) [@Bulduper](https://discourse.nodered.org/u/Bulduper)\
**Post date:** [19 July 2021 12:41 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/1 "2021-07-19T12:41:18Z")

</div>

Hi,  
I need to disable the access to env variables from my flows/nodes. For instance I want the env.get('PASSWORD') to be inaccesible from the function core node.  
I work on Linux Ubuntu and I cannot find the directory/file which would include the Function node source code - editing the source code might be a potential solution.

Or maybe you have some other solution to make env variables **inaccessible**?

Thanks 😃

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [19 July 2021 13:11 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/2 "2021-07-19T13:11:49Z")

</div>

Can you explain the use case for this? The solution may depend on that.

---

<div class="post-metadata">

**Author:** ![Bulduper](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bulduper/32/47322_2.png) [@Bulduper](https://discourse.nodered.org/u/Bulduper)\
**Post date:** [19 July 2021 13:23 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/3 "2021-07-19T13:23:17Z")

</div>

I want to separate the node red service user (who may potentially have access to the flows) from the vulnerable data on the server itself (API keys, passwords etc.). It's basically a security consern.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [19 July 2021 13:30 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/4 "2021-07-19T13:30:05Z")

</div>

Do you want nodes to be configurable via env cars at all?

If not, one workaround would be to add some code to your settings.js file that clears `process.env` of any env vars you don't want the flows to access.

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [19 July 2021 13:34 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/5 "2021-07-19T13:34:51Z")

</div>

You probably need to also block the file and exec nodes.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [19 July 2021 13:50 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/6 "2021-07-19T13:50:44Z")

</div>

Another possibility may be to run node red under Docker. Then it would not be able to access anything on the server that you have not given it access to.

Just preventing access from Function nodes would accomplish little, as env vars can be read via Change nodes, for example.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [19 July 2021 13:55 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/7 "2021-07-19T13:55:09Z")

</div>

> [@Colin](#):
>
> Just preventing access from Function nodes would accomplish little, as env vars can be read via Change nodes, for example.

Indeed - this is where I was going with my question about being able to configure nodes via env vars at all.

We could easily enough add a setting that prevents the env type accessing process.env. The env type would still be useful inside subflows, for example, that can set their own locally-scoped env vars.

---

<div class="post-metadata">

**Author:** ![Bulduper](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bulduper/32/47322_2.png) [@Bulduper](https://discourse.nodered.org/u/Bulduper)\
**Post date:** [19 July 2021 14:14 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/8 "2021-07-19T14:14:07Z")

</div>

All right, you all convinced me that editing the source code is not only inelegant but also inefficient.

> [@knolleary](#):
>
> We could easily enough add a setting that prevents the env type accessing process.env.

That sounds really good. Could you specify what property in `settings.js` would make it work?

> [@Colin](#):
>
> Then it would not be able to access anything on the server that you have not given it access to

Actually I run my nodered server on docker, I just haven't come up with this idea as I'm not very experienced. I will try to find a way to isolate node red container from env vars if the solution with settings.js doesn't satisfy me. Do you have any advices or keywords on this topic?

PS. This forum rocks!!!

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [19 July 2021 14:17 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/9 "2021-07-19T14:17:20Z")

</div>

> [@Bulduper](#):
>
> That sounds really good. Could you specify what property in `settings.js` would make it work?

No such setting exists. I was saying we could add support for one. But that isn't going to happen overnight. It needs someone to do the work to propose a specific change and do the work to implement it.

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [19 July 2021 14:22 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/10 "2021-07-19T14:22:34Z")

</div>

> [@Bulduper](#):
>
> I will try to find a way to isolate node red container from env vars

I think the default in a docker container is to be not able to access the system env vars at all. I don't know what, if any, system env vars the provided node-red docker image does inherit. If you build your own image then you will have full control of that. I hope I am right in stating this as I have not used docker much, but that is my understanding.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [17 September 2021 14:22 UTC](https://discourse.nodered.org/t/disable-access-to-env-vars/48589/11 "2021-09-17T14:22:56Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.