Initially I installed and used NR without any logon requirements. It worked OK. Then I established an admin user and a hashed pwd in settings.js. It worked OK the first time I tried, I was asked to type in the username and the pwd and everything was fine. But the next time (next day) I opened the …

You can find the answer in the last post of this thread: [image] Node Red security password General Hi @kumarsemal - there is no setting available for the runtime to forget about active logins when it is restarted. You can force it by deleting the ~/.node-red/.sessions.j…

Many thanks for your reply - which I will explore (hoping that this file doesn't have to be deleted more than once?) Anyway, I also played around with the sessionExpiryTime as mentioned, and it appears to do what I expected as long as the browsers credential cache is cleared once. Thereafter, the …

The better approach is to use a proxy to access Node-RED and to do authentication, authorisation and access control there. This will give you access to more flexible and more mature capabilities.

The browser offering to auto-fill in your password is nothing to do with the node-red session - that's just Chrome trying to be helpful. If you tell Chrome to 'forget' the credentials, it doesn't log you out - it just tells Chrome to forget the username/password you used previous so it can't try to…

[image] TotallyInformation: This will give you access to more flexible and more mature capabilities. I've seen you make this comment a couple times. If you have feedback on the authentication available via Node-RED, then please do share. Telling users to ignore what we provide and use somethi…

It is a matter of focus - using a proxy to provide authentication and authorisation services for a microservice like Node-RED is a sensible option. Such features have been developed over a long time and often by teams with specific security experience. Node-RED, on the other hand is a general purpo…

[image] knolleary: Telling users to ignore what we provide and use something else doesn't really help us. I couldn't agree more! :clap: Now to my next issue (having solved step #1 with your assistance; When I added logon capability using adminAuth, my flows stopped working :no_mouth: I use …

Node-RED doesn't use basic authentication to secure the admin API. You have to obtain an access token and use that in your requests. Details here: https://nodered.org/docs/api/admin/oauth

Thank you. That solved it :slight_smile

Node-RED

Node-RED Forum

Logon authentication and token expiry

General

Andrei 5 August 2020 11:58 2

You can find the answer in the last post of this thread:

Topic		Replies	Views
Log out from node red flow General	15	2610	1 November 2021
SessionExpirytime not working as expected, can we force the session logout on browser exit.? General	8	202	15 November 2023
Problem authentication General security	8	304	10 November 2023
Node Red security password General	29	24726	21 October 2021
Node-red Configuration "adminAuth sessionExpiryTime" General	1	1279	22 February 2019

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Logon authentication and token expiry

Related topics