# Node-red nginx set up issue

**URL:** <https://discourse.nodered.org/t/node-red-nginx-set-up-issue/35965>\
**Category:** Dashboard\
**Created:** [15 November 2020 17:41 UTC](https://discourse.nodered.org/t/node-red-nginx-set-up-issue/35965 "2020-11-15T17:41:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mick](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/mick/32/80990_2.png) [@Mick](https://discourse.nodered.org/u/Mick)\
**Post date:** [15 November 2020 17:41 UTC](https://discourse.nodered.org/t/node-red-nginx-set-up-issue/35965/1 "2020-11-15T17:41:21Z")

</div>

I am using node-red and have it set up where abc.domain sends to you to a login page where you authenticate then redirects you to /ui using the node-red-contrib-users where I have the base url path set to /. That works fine. However I found a hole in the security. If you go to abc.domain/ui you bypass the login and go straight into the ui. I experimented with nginx sub-filters and was only able to lock out all requests to /ui. My settings.js are:

```auto
httpAdminRoot: 'admin',

ui: { path: "/ui" },

```

Here is Nginx code:

```auto
#proxy for node-red @ port :1880
server {

        server_name abc.domain;

        location = /robots.txt {
                add_header Content-Type text/plain;
                return 200 "User-agent: *\nDisallow: /\n";
        }

        location / {
                #subfilter
                sub_filter_types text/css text/javascript;
                sub_filter ui /;
                sub_filter_once on;

                proxy_pass http://127.0.0.1:1880;

                #Defines the HTTP protocol version for proxying
                #by default it it set to 1.0.
                #For Websockets and keepalive connections you need to use the version 1.1
                proxy_http_version 1.1;

                #Sets conditions under which the response will not be taken from a cache.
                proxy_cache_bypass $http_upgrade;

                #These header fields are required if your application is using Websockets
                proxy_set_header Upgrade $http_upgrade;

                #These header fields are required if your application is using Websockets
                proxy_set_header Connection "upgrade";

                #The $host variable in the following order of precedence contains:
                #hostname from the request line, or hostname from the Host request header field
                #or the server name matching a request.
                proxy_set_header Host $host;

                #Forwards the real visitor remote IP address to the proxied server
                proxy_set_header X-Real-IP $remote_addr;

                #A list containing the IP addresses of every server the client has been proxied through
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

                #When used inside an HTTPS server block, each HTTP response from the proxied server is rewritten to HTTPS.
                proxy_set_header X-Forwarded-Proto $scheme;

                #Defines the original host requested by the client.
                proxy_set_header X-Forwarded-Host $host;

                #Defines the original port requested by the client.
                proxy_set_header X-Forwarded-Port $server_port;

                #Defines sub_filter to accept compressed response.
                proxy_set_header Accept-Encoding "";

           }

}

```

The problem is I can filter out the /ui but then then the redirect from node-red--contrib-users is blocked as well.  
Mick

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [15 December 2020 17:41 UTC](https://discourse.nodered.org/t/node-red-nginx-set-up-issue/35965/2 "2020-12-15T17:41:33Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.