# Node-RED user api to restart the application (Node-RED)
**URL:** https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884
**Category:** Core Development
**Created:** [24 January 2024 16:58 UTC](https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884 "2024-01-24T16:58:03Z")
**Posts on this page:** 4
**Page:** 2
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [25 January 2024 10:03 UTC](https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884/21 "2024-01-25T10:03:30Z")
> [@TotallyInformation](#):
>
> Which reminds me of something I meant to do. I'll add a comment to the security FAQ entry to remind people to protect settings.js from Node-RED itself.
Added, hopefully others will add their thoughts too. π
> [@Protecting Node-RED from itself](https://discourse.nodered.org/t/protecting-node-red-from-itself/84904):
>
> Because Node-RED is a general-purpose computing tool, it has the capabilities to make changes to the underlying Operating System environment. So if you want your instance of Node-RED to be "safe", especially in production and customer environments, it is important to prevent Node-RED from making changes to its own environment. Here are the things you should certainly do as a minimum if you need a secure environment: Protect settings.js While you cannot prevent it from changing certain thinβ¦
> [@Colin](#):
>
> Did you realise that the specific suggestion was to allow the node-red user to use sudo with only the node red restart and reboot commands and nothing else? That does not sound particularly dangerous, or am I missing something?
I did, yes. But as with anything related to security, it is easy to take a specific suggestion and generalise it without thinking through the consequences.
Things are protected by `sudo` for really good reasons, it isn't done lightly. So undoing that - especially if allowing access to editors who possibly don't understand operating system security - is going to have consequences.
In this case, the most obvious would be accidental or deliberate denial-of-service.
There are some things that, while you CAN do them in Node-RED (because it is a _great_ compute environment), doesn't mean that you SHOULD.
There are other, non-Node-RED methods for restarting services which is something that should indeed be restricted to an admin separate to a Node-RED admin. Similarly, you don't HAVE to install/update/remove node modules from Node-RED itself. It is a nice feature but probably terrible in a production environment. In such cases set up a separate admin script that an OS admin has to run. Maybe use Node-RED to create a request form so that your users can still _request_ changes to node modules but an OS admin has to actually run them after due dilligence.
---
### Author:  [@jbudd](https://discourse.nodered.org/u/jbudd)
#### Post date: [25 January 2024 10:24 UTC](https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884/22 "2024-01-25T10:24:11Z")
> [@TotallyInformation](#):
>
> In such cases set up a separate admin script that an OS admin has to run. Maybe use Node-RED to create a request form so that your users can still _request_ changes to node modules but an OS admin has to actually run them after due dilligence.
What is this world of OS administrators, request forms and due diligence? π
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [25 January 2024 12:23 UTC](https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884/23 "2024-01-25T12:23:23Z")
Sorry, I've let me professional life bleed into the world of Node-RED! π
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [25 March 2024 12:23 UTC](https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884/24 "2024-03-25T12:23:28Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.
[Previous page](https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884.md?page=1)