# httpNodeAuth question

**URL:** <https://discourse.nodered.org/t/httpnodeauth-question/48997>\
**Category:** General\
**Created:** [28 July 2021 06:46 UTC](https://discourse.nodered.org/t/httpnodeauth-question/48997 "2021-07-28T06:46:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![QRO](https://avatars.discourse-cdn.com/v4/letter/q/5fc32e/32.png) [@QRO](https://discourse.nodered.org/u/QRO)\
**Post date:** [28 July 2021 06:46 UTC](https://discourse.nodered.org/t/httpnodeauth-question/48997/1 "2021-07-28T06:46:30Z")

</div>

Hello

Via httpNodeAuth: it is possible to control the access to the /ui  
Is there a way to access the /ui from a local address (192.168.1.0/8) without the need to login while access from a remote address there is a need to give user/password?

Thanks!

Peter

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [28 July 2021 08:23 UTC](https://discourse.nodered.org/t/httpnodeauth-question/48997/2 "2021-07-28T08:23:27Z")

</div>

There is no easy way to apply different authentication rules based on the source address in Node-RED.

I can think of 2 ways to approach this,

1. use the `ui: { middleware: function(req,res,next) {...}},` option in `settings.js` to implement an express middleware that implements authentication and only enforces it for client IP addresses outside the given range. This is too complicated to run up an example here without some trial and error and testing.

2. Use something like nginx to proxy for Node-RED and use it to apply the the authentication restrictions. There should be some examples online about how to do this (e.g. [Use nginx to Add Authentication to Any Application | Okta Developer](https://developer.okta.com/blog/2018/08/28/nginx-auth-request) would be a reasonable starting point)

---

<div class="post-metadata">

**Author:** ![hardillb](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/hardillb/32/12373_2.png) [@hardillb](https://discourse.nodered.org/u/hardillb)\
**Post date:** [28 July 2021 08:48 UTC](https://discourse.nodered.org/t/httpnodeauth-question/48997/3 "2021-07-28T08:48:50Z")

</div>

Better nginx auth docs [Restricting Access with HTTP Basic Authentication | NGINX Plus](https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/)

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [28 July 2021 08:57 UTC](https://discourse.nodered.org/t/httpnodeauth-question/48997/4 "2021-07-28T08:57:18Z")

</div>

Caddy also has a load of plugins for different authentication and authorisation schemes.

e.g. [Caddy Auth Portal - Authentication Plugin for Caddy v2 implementing Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0, SAML Authentication - (caddy-auth-portal) (opensourcelibs.com)](https://opensourcelibs.com/lib/caddy-auth-portal)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [26 September 2021 08:57 UTC](https://discourse.nodered.org/t/httpnodeauth-question/48997/5 "2021-09-26T08:57:39Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.