# Node-RED user api to restart the application (Node-RED)

**URL:** <https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884>\
**Category:** Core Development\
**Created:** [24 January 2024 16:58 UTC](https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884 "2024-01-24T16:58:03Z")\
**Posts on this page:** 1\
**Showing post:** 21

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [25 January 2024 10:03 UTC](https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884/21 "2024-01-25T10:03:30Z")

</div>

> [@TotallyInformation](#):
>
> Which reminds me of something I meant to do. I'll add a comment to the security FAQ entry to remind people to protect settings.js from Node-RED itself.

Added, hopefully others will add their thoughts too. 😀

> [@Protecting Node-RED from itself](https://discourse.nodered.org/t/protecting-node-red-from-itself/84904):
>
> Because Node-RED is a general-purpose computing tool, it has the capabilities to make changes to the underlying Operating System environment. So if you want your instance of Node-RED to be "safe", especially in production and customer environments, it is important to prevent Node-RED from making changes to its own environment. Here are the things you should certainly do as a minimum if you need a secure environment: Protect settings.js While you cannot prevent it from changing certain thin…

> [@Colin](#):
>
> Did you realise that the specific suggestion was to allow the node-red user to use sudo with only the node red restart and reboot commands and nothing else? That does not sound particularly dangerous, or am I missing something?

I did, yes. But as with anything related to security, it is easy to take a specific suggestion and generalise it without thinking through the consequences.

Things are protected by `sudo` for really good reasons, it isn't done lightly. So undoing that - especially if allowing access to editors who possibly don't understand operating system security - is going to have consequences.

In this case, the most obvious would be accidental or deliberate denial-of-service.

There are some things that, while you CAN do them in Node-RED (because it is a _great_ compute environment), doesn't mean that you SHOULD.

There are other, non-Node-RED methods for restarting services which is something that should indeed be restricted to an admin separate to a Node-RED admin. Similarly, you don't HAVE to install/update/remove node modules from Node-RED itself. It is a nice feature but probably terrible in a production environment. In such cases set up a separate admin script that an OS admin has to run. Maybe use Node-RED to create a request form so that your users can still _request_ changes to node modules but an OS admin has to actually run them after due dilligence.

---

_[View the full topic](https://discourse.nodered.org/t/node-red-user-api-to-restart-the-application-node-red/84884)._