# How to Disable Node-RED Editor After Running the Dashboard for Security?

**URL:** <https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337>\
**Category:** General\
**Tags:** node-red-dashboard, security\
**Created:** [12 October 2024 06:55 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337 "2024-10-12T06:55:05Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nandhini-Subramaniya](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/nandhini-subramaniya/32/92882_2.png) [@Nandhini-Subramaniya](https://discourse.nodered.org/u/Nandhini-Subramaniya)\
**Post date:** [12 October 2024 06:55 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/1 "2024-10-12T06:55:05Z")

</div>

I’m running a Node-RED dashboard and want to improve security by disabling the Node-RED editor after the dashboard is up and running. My goal is to prevent anyone from accessing the editor and modifying the flows, especially if they know the IP address.

I have a couple of requirements:

1. **Secure the dashboard** : The dashboard should remain accessible while the editor is disabled.
2. **Prevent flow modifications** : Once the editor is disabled, no one should be able to access it or deploy changes via the editor interface.

I tried setting `enabled: false` under the `editorTheme` section in the `settings.js` file, but the editor is still accessible after a restart.

Can anyone provide guidance on how to fully disable the Node-RED editor while keeping the dashboard functional? Are there alternative methods like firewalls, reverse proxies, or API calls that can be used to achieve this?

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [12 October 2024 07:16 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/2 "2024-10-12T07:16:48Z")

</div>

Hi @Nandhini-Subramaniya

Who or what is accessing the Dashboard?  
is this being accessed from within the same network?

If so, any reason you can't just use the built in editor login mechanism.

```auto
adminAuth: {
    type: "credentials",
    users: [
        {
            username: "admin",
            password: "$2a$08$zZWtXTja0fB1pzD4sHCMyOCMYz2Z6dNbM6tl8sJogENOMcxWV9DN.",
            permissions: "*"
        },
        {
            username: "george",
            password: "$2b$08$wuAqPiKJlVN27eF5qJp.RuQYuy6ZYONW7a/UWYxDTtwKFCdB8F19y",
            permissions: "read"
        }
    ]
}

```

This will allow you to lock the editor, with a username / password.

If access is happening within the same Network - this should be "good enough", but if being accessed by WAN - then yes, Reverse Proxies, tunnelling is the way.

@TotallyInformation is knowledgeable here, if you go down that route

> [@Nandhini-Subramaniya](#):
>
> I tried setting `enabled: false` under the `editorTheme` section in the `settings.js` file, but the editor is still accessible after a restart.

I have never heard of that happening, do you have something reverting those changes during start up?

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [12 October 2024 07:55 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/3 "2024-10-12T07:55:56Z")

</div>

> [@Nandhini-Subramaniya](#):
>
> **Prevent flow modifications** : Once the editor is disabled, no one should be able to access it or deploy changes via the editor interface.

You can do this is several ways:

- via securing node-red
  - @marcus-j-davies mentions that in the above ☝post

- via `disableEditor` flag in settings.js: [Configuration : Node-RED](https://nodered.org/docs/user-guide/runtime/configuration)
  - 

> if set to `true`, prevents the editor UI from being served by the runtime. The admin api endpoints remain active. Default: `false`.

- via `httpAdminRoot` flag in settings.js: [Configuration : Node-RED](https://nodered.org/docs/user-guide/runtime/configuration)
  - 

> the root url for the editor UI. If set to `false` , all admin endpoints are disabled. This includes both API endpoints and the editor UI. To disable just the editor UI, see the `disableEditor` property below. Default: `/`

  

> [@Nandhini-Subramaniya](#):
>
> I tried setting `enabled: false` under the `editorTheme` section in the `settings.js` file, but the editor is still accessible after a restart.

As mentioned above, this is not doing what you think (you have the wrong thing!)

Also, check you are modifing the right file. What does your node-red log say at start up (it tells you the settings file it is using)

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [12 October 2024 07:58 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/4 "2024-10-12T07:58:14Z")

</div>

> [@marcus-j-davies](#):
>
> > [@Nandhini-Subramaniya](#):
> >
> > I tried setting `enabled: false` under the `editorTheme` section in the `settings.js` file, but the editor is still accessible after a restart.
> 
> I have never heard of that happening, do you have something reverting those changes during start up?

Wrong flag Marcus. See my post above

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [12 October 2024 08:01 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/5 "2024-10-12T08:01:27Z")

</div>

Ah!

Thanks, hence the confusion 🫠, I knew it should have disabled the thing, but yeah, change the right thing 👍

(And I use that often as well! 😇)

---

<div class="post-metadata">

**Author:** ![Nandhini-Subramaniya](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/nandhini-subramaniya/32/92882_2.png) [@Nandhini-Subramaniya](https://discourse.nodered.org/u/Nandhini-Subramaniya)\
**Post date:** [12 October 2024 09:22 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/6 "2024-10-12T09:22:27Z")

</div>

I just wanted to take a moment to express my gratitude for the support and guidance provided regarding the `disableEditor` and `httpAdminRoot` flags in Node-RED. Your insights were incredibly helpful in clarifying how to manage access to the editor UI and admin API.

Thanks to your explanations, I was able to resolve the issue I was facing. I truly appreciate the time and effort you put into answering my questions.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [12 October 2024 10:47 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/7 "2024-10-12T10:47:37Z")

</div>

I would like to add that, in my opinion, by far the best way to secure the Editor separate to any user-facing endpoints (including Dashboard), would be to use an external proxy to ensure that access to the Editor can only _ever_ happen from an appropriate client with appropriate security.

There are many proxy services that can help with this. A relatively easy approach if you are accessing things over the Internet would be to use Cloudflare Zero Trust where you simply only route the Dashboard to the Internet via the cloud proxy and leave the Editor to only be accessible from your local network.

This is only 1 example configuration.

Doing security outside of Node-RED is almost always going to be more effective and secure.

---

<div class="post-metadata">

**Author:** ![vivekdna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/vivekdna/32/95382_2.png) [@vivekdna](https://discourse.nodered.org/u/vivekdna)\
**Post date:** [12 October 2024 13:14 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/8 "2024-10-12T13:14:45Z")

</div>

Thank you for your input. Yes, we will be using HAProxy with security policies and URL routing to safeguard editor access. We truly appreciate your quick response and support.

We’ve begun exploring Node-Red and are highly impressed with its architecture and design, which significantly streamlines our application development.

Thank you

---

<div class="post-metadata">

**Author:** ![joepavitt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/joepavitt/32/59722_2.png) [@joepavitt](https://discourse.nodered.org/u/joepavitt)\
**Post date:** [12 October 2024 13:37 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/9 "2024-10-12T13:37:27Z")

</div>

You may also want to consider [FlowFuse](https://flowfuse.com/), it's built by the same team as Node-RED, and includes a lot of the security layers you're after, by default. It has a free, self-hosted option, but also comes with paid tiers for additional features should they be required.

_Note: I work for FlowFuse_

---

<div class="post-metadata">

**Author:** ![vivekdna](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/vivekdna/32/95382_2.png) [@vivekdna](https://discourse.nodered.org/u/vivekdna)\
**Post date:** [13 October 2024 15:54 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/10 "2024-10-13T15:54:24Z")

</div>

Thank you @joepavitt ! We will certainly explore the FlowFuse cloud offering. We’ve just begun learning Node-Red’s capabilities to develop an enterprise application.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [11 January 2025 15:55 UTC](https://discourse.nodered.org/t/how-to-disable-node-red-editor-after-running-the-dashboard-for-security/92337/11 "2025-01-11T15:55:24Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.