# Http request auth digest msg input?

**URL:** <https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051>\
**Category:** General\
**Created:** [3 November 2026 13:38 UTC](https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051 "2026-11-03T13:38:32Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![ThingsTinkerer](https://avatars.discourse-cdn.com/v4/letter/t/91b2a8/32.png) [@ThingsTinkerer](https://discourse.nodered.org/u/ThingsTinkerer)\
**Post date:** [3 November 2026 13:38 UTC](https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051/1 "2026-11-03T13:38:32Z")

</div>

Hi, need to use auth digest for a http request. But I'm only able to enter into the password field of the http request node settings, thus leaking into git (together with the password which is stored in a nearby config file).

How can auth digest be used with http securely through env.get as msg parameter in input to the node? Otherwise I have to manually add code for the digest mechanics in a separate step before the request.

---

<div class="post-metadata">

**Author:** ![ThingsTinkerer](https://avatars.discourse-cdn.com/v4/letter/t/91b2a8/32.png) [@ThingsTinkerer](https://discourse.nodered.org/u/ThingsTinkerer)\
**Post date:** [3 November 2026 13:45 UTC](https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051/2 "2026-11-03T13:45:40Z")

</div>

Nevermind, password field supports env arg directly like `${PASS}`, brilliant!

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [3 November 2026 14:10 UTC](https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051/3 "2026-11-03T14:10:59Z")

</div>

But also the values should be encrypted in the flows\_creds.json, if you are using the projects feature the secret used to do the encryption should not be checked into git.

---

<div class="post-metadata">

**Author:** ![ThingsTinkerer](https://avatars.discourse-cdn.com/v4/letter/t/91b2a8/32.png) [@ThingsTinkerer](https://discourse.nodered.org/u/ThingsTinkerer)\
**Post date:** [3 November 2026 14:20 UTC](https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051/4 "2026-11-03T14:20:30Z")

</div>

That's futile when the password to decrypt flows\_creds.json is also in git right next flows\_creds.json itself. Password to decrypt is stored in clear text in .config.projects.json. We never store any secrets in node red nor its secrets vault.

I could of course put .config.projects.json on git ignore? But what's the point, it only stores secrets that's entered in specially allocated fields. Our secrets are used many other places, like function nodes. And for that we need .env, not nr secrets storage?

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [3 November 2026 14:22 UTC](https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051/5 "2026-11-03T14:22:47Z")

</div>

> Password to decrypt is stored in clear text in .config.projects.json. We never store any secrets in node red nor its secrets vault.

Using the [Projects feature](https://nodered.org/docs/user-guide/projects/) that value should not be checked in, you should be asked for it at the time you check out the project.

Now, if you are managing storing flows in Git yourself, then yes you have to manage that yourself.

There are also nodes to inject secrets into flows and store them in the credentials store.

e.g. [node-red-contrib-credentials (node) - Node-RED](https://flows.nodered.org/node/node-red-contrib-credentials)

---

<div class="post-metadata">

**Author:** ![ThingsTinkerer](https://avatars.discourse-cdn.com/v4/letter/t/91b2a8/32.png) [@ThingsTinkerer](https://discourse.nodered.org/u/ThingsTinkerer)\
**Post date:** [3 November 2026 14:24 UTC](https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051/6 "2026-11-03T14:24:37Z")

</div>

We could treat .config.projects.json essentially as an indirect env file yes. But when we already need env file for other purposes, it just adds on what we already got.

---

<div class="post-metadata">

**Author:** ![ThingsTinkerer](https://avatars.discourse-cdn.com/v4/letter/t/91b2a8/32.png) [@ThingsTinkerer](https://discourse.nodered.org/u/ThingsTinkerer)\
**Post date:** [3 November 2026 14:27 UTC](https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051/7 "2026-11-03T14:27:54Z")

</div>

Sure, having support for additional nodes to do that work can be useful. If you want to go down that route. From my point of view, it'll just be more dependencies, more clutter in flows with additional nodes. All this to simply do the same as env.get("PASS") which is supported universally without extra nodes or libraries. I just don't see the benefit. Feels like a lot of effort to avoid very simple js.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [3 November 2026 15:11 UTC](https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051/8 "2026-11-03T15:11:14Z")

</div>

Also worth noting a couple of things about environment variables:

1. Environment variables are _NOT A SECURITY FEATURE!_ Any compromise of the server also compromises any active environment variables.

2. Now that Node-RED v5 baselines on node.js v22+, you can start node-red with a node.js parameter that will automatically read a `.env` file in the startup folder. Unlike trying to add an export before the node-red start command, this is fully cross-platform.

---

<div class="post-metadata">

**Author:** ![ThingsTinkerer](https://avatars.discourse-cdn.com/v4/letter/t/91b2a8/32.png) [@ThingsTinkerer](https://discourse.nodered.org/u/ThingsTinkerer)\
**Post date:** [3 November 2026 16:34 UTC](https://discourse.nodered.org/t/http-request-auth-digest-msg-input/102051/9 "2026-11-03T16:34:51Z")

</div>

Been down this road before, any compromise of env is same as compromise of the config file. They live in the same space, so suffer exactly the same vulnerabilities.

Cool to hear native support of .env, currently using env.json file imported in settings.js.