# Enable Dashboard Access but deny flow adaptions

**URL:** <https://discourse.nodered.org/t/enable-dashboard-access-but-deny-flow-adaptions/52935>\
**Category:** Dashboard\
**Created:** [29 October 2021 10:24 UTC](https://discourse.nodered.org/t/enable-dashboard-access-but-deny-flow-adaptions/52935 "2021-10-29T10:24:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Darwin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/darwin/32/44600_2.png) [@Darwin](https://discourse.nodered.org/u/Darwin)\
**Post date:** [29 October 2021 10:24 UTC](https://discourse.nodered.org/t/enable-dashboard-access-but-deny-flow-adaptions/52935/1 "2021-10-29T10:24:41Z")

</div>

Hi,

I've got the following use case: I would like to have a user which is fully capable to interact with the dashboard, while any real adaptions on the flows should not be permitted.  
According to [Securing Node Red](https://nodered.org/docs/user-guide/runtime/securing-node-red) I created a default user that has only read options for the flow, and another Pw user that has full access.

No what I've got is: The flows are readable but not adaptable. Meaning I can see everything but not deploy changes. However, if I try to access the dashboard a login is required. I was hoping that in this case no login is required to access the dashboard.

Is there any option to realize what I am trying to achieve? So no password for accessing the dashboard ui, but a password to adapt the flows? - Just to be clear on that: I do not need more than one user, just a "not signed in" and a "signed in" behaviour.

Also I've got one additional question that just concerns node-red security itself: Is there a permission that may let the user check the flow itself, but not the contents of each node? Since some config nodes contain passwords that would also be great.

Thanks in advance for your time.

BR Darwin

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [29 October 2021 11:00 UTC](https://discourse.nodered.org/t/enable-dashboard-access-but-deny-flow-adaptions/52935/2 "2021-10-29T11:00:25Z")

</div>

At a guess, you have set `httpNodeAuth` and `adminAuth`

- `adminAuth` is for logging into node-red editor
- `httpNodeAuth` is for nodes (e.g. dashboard)

Undo any changes to `httpNodeAuth` and it should function as expected.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [29 October 2021 11:12 UTC](https://discourse.nodered.org/t/enable-dashboard-access-but-deny-flow-adaptions/52935/3 "2021-10-29T11:12:26Z")

</div>

> [@Darwin](#):
>
> Also I've got one additional question that just concerns node-red security itself: Is there a permission that may let the user check the flow itself, but not the contents of each node? Since some config nodes contain passwords that would also be great.

No, the permissions are not that fine grained. However, it should also be the case that nodes that contain passwords have properly flagged them as credentials. Any credential type property are never returned to the editor after they have been set - they simply don't appear in the flow json the editor loads. So it is not possible for any user, read-only or otherwise, to get access to passwords after they have been set.

If you know of any config nodes that do still expose the password after it has been set (and the editor itself reloaded), then please let us know - or better yet, raise an issue on the node so it can be updated to follow the proper practices.

---

<div class="post-metadata">

**Author:** ![Darwin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/darwin/32/44600_2.png) [@Darwin](https://discourse.nodered.org/u/Darwin)\
**Post date:** [2 November 2021 10:53 UTC](https://discourse.nodered.org/t/enable-dashboard-access-but-deny-flow-adaptions/52935/4 "2021-11-02T10:53:23Z")

</div>

Thank you ver much for the quick response. I somehow managed to overread this in the description!

---

<div class="post-metadata">

**Author:** ![Darwin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/darwin/32/44600_2.png) [@Darwin](https://discourse.nodered.org/u/Darwin)\
**Post date:** [2 November 2021 11:30 UTC](https://discourse.nodered.org/t/enable-dashboard-access-but-deny-flow-adaptions/52935/5 "2021-11-02T11:30:59Z")

</div>

Ok thanks for the hint. I passed user information to subflows via params, which is where the passwords got stored. I now store all passwords directly in the nodes, and I realized that the credentials of the nodes I use are properly secured. Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [16 November 2021 11:31 UTC](https://discourse.nodered.org/t/enable-dashboard-access-but-deny-flow-adaptions/52935/6 "2021-11-16T11:31:30Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.