# Misleading error message after restart?

**URL:** <https://discourse.nodered.org/t/misleading-error-message-after-restart/101915>\
**Category:** General\
**Tags:** security\
**Created:** [16 October 2026 13:13 UTC](https://discourse.nodered.org/t/misleading-error-message-after-restart/101915 "2026-10-16T13:13:02Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [16 October 2026 13:13 UTC](https://discourse.nodered.org/t/misleading-error-message-after-restart/101915/1 "2026-10-16T13:13:02Z")

</div>

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/4/7/47784168625d9654fa897f9e1fa70ff5be6bdc9e.png)

The above is after several restarts and even Editor page reloads - the display shows that the user called "read" is logged in but not only should they not be but it appears that they actually are not.

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/d/b/dbb794c1b1d495f721cb5a8257c4e2dfc583f62b.png)

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [16 October 2026 19:32 UTC](https://discourse.nodered.org/t/misleading-error-message-after-restart/101915/2 "2026-10-16T19:32:49Z")

</div>

Aren't the tokens signed and timed - I'm not sure of the mechanics it uses?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [16 October 2026 19:40 UTC](https://discourse.nodered.org/t/misleading-error-message-after-restart/101915/3 "2026-10-16T19:40:05Z")

</div>

Well, I'm realising I knew even less than I thought. But I can say for sure that Node-RED logins do not behave how I would expect them to work.

---

<div class="post-metadata">

**Author:** ![marcus-j-davies](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/marcus-j-davies/32/103435_2.png) [@marcus-j-davies](https://discourse.nodered.org/u/marcus-j-davies)\
**Post date:** [16 October 2026 19:49 UTC](https://discourse.nodered.org/t/misleading-error-message-after-restart/101915/4 "2026-10-16T19:49:30Z")

</div>

I think the large webscoket interaction may have a role to play here.

- sometimes. - I get a login window appear over the top of my rendered flow canvas, when visiting the workspace

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [16 October 2026 20:15 UTC](https://discourse.nodered.org/t/misleading-error-message-after-restart/101915/5 "2026-10-16T20:15:45Z")

</div>

I normally ignore Node-RED's login but I've had a request to make some improvements to UIBUILDER. As you know, my usual advice is to use an external IdM tool.

---

<div class="post-metadata">

**Author:** ![gordian](https://avatars.discourse-cdn.com/v4/letter/g/7ab992/32.png) [@gordian](https://discourse.nodered.org/u/gordian)\
**Post date:** [19 October 2026 12:55 UTC](https://discourse.nodered.org/t/misleading-error-message-after-restart/101915/6 "2026-10-19T12:55:29Z")

</div>

On marcus' question: the editor tokens aren't signed or timed in the JWT sense. Going by the editor-api code in 5.0.x:

- On login Node-RED creates a random token (`crypto.randomBytes(128)`) and keeps the session on the server. The browser keeps the token in localStorage under `auth-tokens`.
- The sessions are written to `.sessions.json` in the userDir and loaded again at startup, so a restart doesn't log anyone out. That's by design. A session only goes away when it expires (`adminAuth.sessionExpiryTime`, default 604800 seconds = 7 days) or when the user picks Logout, which posts to `auth/revoke`.
- On each request the token is looked up and the user is then found by name in the current `adminAuth.users`. If that user no longer exists, the token is rejected. But the scope comes from the stored session (`done(null, user, {scope: token.scope})` in `strategies.js`), not from the user's current `permissions`. So if you change the `read` user's permissions in settings.js and restart, an existing session keeps the scope it had at login until it expires or is revoked.

If you want a restart to log everyone out, stop Node-RED, delete `.sessions.json` and start it again. A shorter `sessionExpiryTime` limits how long an old session can live.

(Disclosure: I'm connected to thirds.ai.)

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [19 October 2026 13:01 UTC](https://discourse.nodered.org/t/misleading-error-message-after-restart/101915/7 "2026-10-19T13:01:48Z")

</div>

Many thanks for that detail, very helpful. It make sense and reinforces what I've always said - use a proper external IdM tool to correctly enforce authentication and authorisation.

I that case though, I think there may be a bug?

Because while the Editor shows that the user is still logged in - I'm not sure they are?

Or, at least, the error message may be misleading. It is possible that the user is logged in but not permitted to access the settings since they only have "read" access? If that is the case, the message needs updating to say something like:

```plaintext
You must be logged in with appropriate access to access settings

```

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [19 October 2026 13:04 UTC](https://discourse.nodered.org/t/misleading-error-message-after-restart/101915/8 "2026-10-19T13:04:35Z")

</div>

Renamed this thread for clarity.