Login example for node-red-contrib-uibuilder dashboard is needed

Can we just be clear here - there is only 1 uibuilder :sunglasses:

The main alternative is called Dashboard. Then there are 1 or two other UI building contrib nodes some of which aren't particularly supported or are just getting off the ground.

But currently, Dashboard (maintained in core mostly by Dave with additional contributed ui-xxxx nodes from others) and node-red-contrib-uibuilder (or just "uibuilder" for short) which is mostly developed and supported by me with some notable contributions by others.

Dashboard is aimed at folk who need to rapidly put together a user accessible Dashboard but who generally don't want to do coding for it. uibuilder is aimed at creating general-purpose, data-driven web apps backed by Node-RED. uibuilder can, of course, also build Dashboards but it can do just about anything you can think of doing with a web app. But you need to write at least a small amount of code.

Python and other things you mention are different really and we could unpack that separately if needed.

Which was one of the drivers behind the creation of uibuilder. But, Dashboard has been a massive boon to Node-RED as it meets the same low-code aspirations of Node-RED itself and means that non-coders can create UI's and even coders can throw something interactive together quickly.

Then don't use Dashboard :slight_smile: But seriously, if you need to simplify or change that url, it is possible by using a reverse proxy service. However, it is what it is because of the tools used to create the framework. The same framework that makes its use simple.

Dashboard is complex so that usage does not need to be complex to use. That is the nature of frameworks. With uibuilder, there is an expectation that you will know or learn at least some basic skills in creating and managing HTTP/HTML/CSS/JS/WEBSOCKETS apps. You don't actually need a lot but you do need some.

Remember that Dashboard was originally built by a contributor and gifted to Node-RED. It uses v1 of the Angular framework which is one of the older and more complex frameworks. Dave gamely stepped up to the plate to try and support it and develop it. But at the end of the day, the underlying code is extremely complex and build around a deprecating framework.

Nice of you to say so :smiley: I think that everyone agrees that a new Dashboard capability is needed for Node-RED. But as yet, nobody has fully stepped up to create one. Though TVE is busy creating something and I've been trying to work uibuilder towards a foundation platform that a no-code dashboard can be build on and have provided some examples of how that might work (but I don't have the time to do the whole thing at the moment I'm afraid).

I took a difficult decision to pull the dedicated login and other security processing from uibuilder for v5. The reason being that it is very hard to get right and it ended up holding back other beneficial developments.

My recommendation for securing Node-RED based UI's, regardless of how they are delivered, however is to use external authentication and authorisation.

As such, I spent some time starting to put together examples for uibuilder (that could fairly easily be adapted to Dashboard, etc).

Using NGINX for authentication and authorisation to Node-RED - FAQs - Node-RED Forum (nodered.org)

Overview of general web app security with some specifics for Node-RED and uibuilder (totallyinformation.github.io)

The issue is that there are a great many ways to secure a web app and things can quickly get complex when you try to do things that are genuinely secure. Be very sceptical of tutorials that make it seem simple. I do enterprise and government-level security in my day-job so I do know a bit about it.

The next example I'm working on will be more complex but more realistic that the above. But it will still use NGINX to provide the security wrapper.


In the meantime, by using the "new" client library for uibuilder, you get access to additional client information such as IP addresses and a more stable client UID that you can use to provide some basic security along with HTTP Digest authentication via NGINX from the examples.