# Locking down the dashboard

**URL:** <https://discourse.nodered.org/t/locking-down-the-dashboard/98088>\
**Category:** Dashboard\
**Tags:** dashboard-2\
**Created:** [11 July 2025 18:18 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088 "2025-07-11T18:18:53Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![fischgeek](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/fischgeek/32/99952_2.png) [@fischgeek](https://discourse.nodered.org/u/fischgeek)\
**Post date:** [11 July 2025 18:18 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/1 "2025-07-11T18:18:53Z")

</div>

Forgive the ignorance but...

Is there any other way of locking down the dashboard per user other than paying for FlowFuse? I get that Dashboard 2.0 is a FlowFuse product, but there must be a way to do this other than buying yet another subscription.

I have tried the `httpNodeAuth` route but that had undesired side-effects I wasn't looking for. I honestly forget what they were (I'll try it again) but I know I reverted that setting for a reason.

What I'm trying to do is give certain users access to a specific page on the dashboard; not all pages. I also don't want to give users access to the flows at all.

I have read the [Securing Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red#http-node-security) page but honestly it's a little confusing for me. Can that be leveraged to do what I want?

Thanks!

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [11 July 2025 21:01 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/2 "2025-07-11T21:01:06Z")

</div>

> [@fischgeek](#):
>
> Is there any other way of locking down the dashboard per user other than paying for FlowFuse?

Yes.

> [@fischgeek](#):
>
> I get that Dashboard 2.0 is a FlowFuse product, but there must be a way to do this other than buying yet another subscription.

Yes. 😊

> [@fischgeek](#):
>
> I have read the [Securing Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red#http-node-security) page but honestly it's a little confusing for me. Can that be leveraged to do what I want?

Maybe but probably the wrong route anyway.

So I have always advocated that people use proper security tools for securing services, especially web services. In this case, that means using a reverse proxy (e.g. NGINX, Caddy, HAProxy, etc) along with one of the authentication services (e.g. FusionAuth, Authentik, Authelia, etc.)

Alternatively, simply use Cloudflare Zero Trust which provides a single integrated set of cloud services to do both the proxy and the authentication without you needing to put holes in your own firewall.

Both D2 and UIBUILDER can use standard auth headers to help control access. Just note however that D2 is a single-page-app only so you might struggle depending on security levels required (not totally sure as I don't use it). With UIBUILDER, you can build anything and you can choose between single and multi-page apps (or indeed both) and you can easily insert middleware on both the HTTP and WS (actually [Socket.IO](http://Socket.IO)) protocols on the Node-RED server side for best control.

Also worth remembering when using websockets (and [Socket.IO](http://Socket.IO)) that ws does not support custom http headers. This means that, while you can control an initial hanshake, you cannot then continue to control further interactions without additional work. UIBUILDER allows middleware on each msg as well as the initial handshake to help with this.

---

<div class="post-metadata">

**Author:** ![omrid](https://avatars.discourse-cdn.com/v4/letter/o/77aa72/32.png) [@omrid](https://discourse.nodered.org/u/omrid)\
**Post date:** [11 July 2025 21:37 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/3 "2025-07-11T21:37:47Z")

</div>

On a related note, is there a way to lock/hide specific editor tabs (or specific subflows)?

The use-case is that we want to expose the editor to end-users, allowing them to create their own flows. We want to empower them with some generic tabs/subflows which they can call **but cannot modify**.  
Is there a way to do this? Of course, I can develop & provide custom nodes, remote API interfaces or executables (called by exec nodes), but it would be nice to be able to leverage Node-red itself for building (and locking) these generic tabs/subflows.

Any ideas?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [11 July 2025 22:22 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/4 "2025-07-11T22:22:53Z")

</div>

> [@omrid](#):
>
> On a related note, is there a way to lock/hide specific editor tabs (or specific subflows)?

Not natively in Node-RED, I don't believe.

> [@omrid](#):
>
> We want to empower them with some generic tabs/subflows which they can call **but cannot modify**.  
> Is there a way to do this?

I don't think so directly. You could stand up a separate Node-RED instance and use that as an API server.

---

<div class="post-metadata">

**Author:** ![omrid](https://avatars.discourse-cdn.com/v4/letter/o/77aa72/32.png) [@omrid](https://discourse.nodered.org/u/omrid)\
**Post date:** [12 July 2025 00:54 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/5 "2025-07-12T00:54:52Z")

</div>

Thanks Julian

---

<div class="post-metadata">

**Author:** ![joepavitt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/joepavitt/32/59722_2.png) [@joepavitt](https://discourse.nodered.org/u/joepavitt)\
**Post date:** [12 July 2025 06:42 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/6 "2025-07-12T06:42:47Z")

</div>

This functionality is supported in FlowFuse. If you're using Node-RED in a business setting, then itd pribably easy to justify the FF cost in the time saving you'd get.

---

<div class="post-metadata">

**Author:** ![joepavitt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/joepavitt/32/59722_2.png) [@joepavitt](https://discourse.nodered.org/u/joepavitt)\
**Post date:** [12 July 2025 06:43 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/7 "2025-07-12T06:43:35Z")

</div>

> **[Building Multi-Tenant Dashboards | Node-RED Dashboard 2.0](https://dashboard.flowfuse.com/user/multi-tenancy#authentication-providers)**
>
> Discover the features and benefits of FlowFuse Dashboard, designed to streamline and enhance your Node-RED experience.

There are many open-source authentication providers that work with FlowFuse Dashboard, not just FlowFuse

---

<div class="post-metadata">

**Author:** ![omrid](https://avatars.discourse-cdn.com/v4/letter/o/77aa72/32.png) [@omrid](https://discourse.nodered.org/u/omrid)\
**Post date:** [12 July 2025 09:06 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/8 "2025-07-12T09:06:51Z")

</div>

> [@joepavitt](#):
>
> There are many open-source authentication providers that work with FlowFuse Dashboard, not just FlowFuse

Thanks, Joe.  
I am familiar with how to authenticate & implement multi-tenant dashboards, and D-2 has really enhanced this capability (thanks!).

In this case, what I am looking for is multi-tenant **editor** access. AFAIK, I can authenticate the editor in "all or nothing" mode, i.e. once authenticated, I can modify anything.  
I'm looking for selective view/modify permissions to specific tabs or subflows **within the editor** (i.e. protecting selective parts of a flows.json file, like protecting specific sheets in an Excel workbook). We have lock/unlock at tab level, but is there a way to control who can unlock a tab?

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [12 July 2025 09:52 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/9 "2025-07-12T09:52:11Z")

</div>

> [@omrid](#):
>
> In this case, what I am looking for is multi-tenant **editor** access.

In that case this is not the best thread to discuss it as it is nothing to do with the flowfuse dashboard.

---

<div class="post-metadata">

**Author:** ![joepavitt](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/joepavitt/32/59722_2.png) [@joepavitt](https://discourse.nodered.org/u/joepavitt)\
**Post date:** [14 July 2025 08:34 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/10 "2025-07-14T08:34:55Z")

</div>

> [@omrid](#):
>
> In this case, what I am looking for is multi-tenant **editor** access. AFAIK, I can authenticate the editor in "all or nothing" mode, i.e. once authenticated, I can modify anything.  
> I'm looking for selective view/modify permissions to specific tabs or subflows **within the editor** (i.e. protecting selective parts of a flows.json file, like protecting specific sheets in an Excel workbook). We have lock/unlock at tab level, but is there a way to control who can unlock a tab?

Yes, this is a FlowFuse feature set. It's purpose is to make multi Node-RED instance management a breeze. As Colin has mentioned though, that's a different thread from the original topic. Please do reach out if you want to chat FlowFuse.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [13 August 2025 08:35 UTC](https://discourse.nodered.org/t/locking-down-the-dashboard/98088/11 "2025-08-13T08:35:14Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.