# How best to restrict an httpNodeMiddleware function to certain endpoints
**URL:** https://discourse.nodered.org/t/how-best-to-restrict-an-httpnodemiddleware-function-to-certain-endpoints/79351
**Category:** General
**Tags:** security
**Created:** [22 June 2023 09:46 UTC](https://discourse.nodered.org/t/how-best-to-restrict-an-httpnodemiddleware-function-to-certain-endpoints/79351 "2023-06-22T09:46:25Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@mpolling](https://discourse.nodered.org/u/mpolling)
#### Post date: [22 June 2023 09:46 UTC](https://discourse.nodered.org/t/how-best-to-restrict-an-httpnodemiddleware-function-to-certain-endpoints/79351/1 "2023-06-22T09:46:25Z")
I am using some middleware functions to get authentication/authorization on my endpoints. (Doing it this way because I don't want to bother with that in my flows, and I want OAuth2 instead of basic auth.)
I got it working with the Auth0 service (let's you play for free!), and the express-openid-connect module.
I have this in my `settings.js`:
```auto
// at the top
const { auth, requiresAuth } = require('express-openid-connect');
```
```auto
// in module.exports
httpNodeMiddleware: [
auth({
authRequired: false,
issuerBaseURL: 'https://dev-some_unique_id.eu.auth0.com',
baseURL: 'https://localhost/',
clientID: 'some id that I prefer not to share',
secret: 'some secret that I prefer not to share',
idpLogout: true,
routes: {
callback: '/mycallback'
},
}),
function (req, res, next) {
var url = require("url");
if (url.parse(req.url).pathname == '/test2') {
requiresAuth()(req, res, next);
} else {
next();
}
}
],
```
The second function in the middleware is used to require auth only for my `/test2` endpoint. But I find this approach not very elegant, when the [express-openid-connect examples](https://github.com/auth0/express-openid-connect/blob/master/EXAMPLES.md) indicate that it can be done this way in "plain express.js":
```auto
app.get('/restricted', requiresAuth(), (req, res) =>
res.send(`Hello ${req.oidc.user.sub}, this is the restricted section.`)
);
```
Does Node-RED also allow attaching a middleware to only some endpoints in a similar way, where you get to mention the path to the endpoint, and attach/inject a function?
---
### Author:  [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [22 June 2023 10:09 UTC](https://discourse.nodered.org/t/how-best-to-restrict-an-httpnodemiddleware-function-to-certain-endpoints/79351/2 "2023-06-22T10:09:31Z")
Hi @mpolling
unfortunately the `httpNodeMiddleware` setting isn't that flexible. It gets applied to all routes - so you'd need to add some code at the start of the middleware to decide whether it should apply for the particular request and either return early or continue to handle the request.
Providing more flexible auth options to individual HTTP In nodes is something I've been thinking a bit about - but not something that's going to happen immediately.
---
### Author:  [@mpolling](https://discourse.nodered.org/u/mpolling)
#### Post date: [22 June 2023 12:53 UTC](https://discourse.nodered.org/t/how-best-to-restrict-an-httpnodemiddleware-function-to-certain-endpoints/79351/3 "2023-06-22T12:53:14Z")
Thanks for that. So, I guess my solution to check the path of the endpoint inside that middleware function, can be regarded best practice for now?
I.e., this little bit from the fragment above:
```auto
if (url.parse(req.url).pathname == '/test2') {
requiresAuth()(req, res, next);
} else {
next();
}
```
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [22 June 2023 16:42 UTC](https://discourse.nodered.org/t/how-best-to-restrict-an-httpnodemiddleware-function-to-certain-endpoints/79351/4 "2023-06-22T16:42:12Z")
Depending on what your endpoints are, you could instead try uibuilder which has its own middleware features.
At present its middleware is "global" to all uibuilder instances in Node-RED however, the next release should include per-instance middleware.
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [6 July 2023 16:42 UTC](https://discourse.nodered.org/t/how-best-to-restrict-an-httpnodemiddleware-function-to-certain-endpoints/79351/5 "2023-07-06T16:42:12Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.