# Prevent anonymous editor access on IBM Cloud Code Engine

**URL:** <https://discourse.nodered.org/t/prevent-anonymous-editor-access-on-ibm-cloud-code-engine/64163>\
**Category:** General\
**Created:** [20 June 2022 10:53 UTC](https://discourse.nodered.org/t/prevent-anonymous-editor-access-on-ibm-cloud-code-engine/64163 "2022-06-20T10:53:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bthj](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bthj/32/63510_2.png) [@bthj](https://discourse.nodered.org/u/bthj)\
**Post date:** [20 June 2022 10:53 UTC](https://discourse.nodered.org/t/prevent-anonymous-editor-access-on-ibm-cloud-code-engine/64163/1 "2022-06-20T10:53:03Z")

</div>

Hi,

I have Node-RED running on Code Engine in the IBM Cloud, based on the [Node-RED Starter Kit](https://developer.ibm.com/tutorials/how-to-create-a-node-red-starter-application/). Even though I configured user user credentials during the setup, anyone can visit the editor and view the logs, which I would like to prevent. There is documentation on the NODE\_RED\_GUEST\_USER environment variable, but I haven't been able to set it effectively to false, to prevent anonymous read access. For example, on the Code Engine Application _Environment variables_ tab I've set NODE\_RED\_GUEST\_USER as literal false, with no effect.

Any idea on what can be done in this hosting environment to prevent anonymous read access to the editor UI?

---

<div class="post-metadata">

**Author:** ![bthj](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bthj/32/63510_2.png) [@bthj](https://discourse.nodered.org/u/bthj)\
**Post date:** [20 June 2022 12:02 UTC](https://discourse.nodered.org/t/prevent-anonymous-editor-access-on-ibm-cloud-code-engine/64163/2 "2022-06-20T12:02:49Z")

</div>

In my copy of the `Node-RED IBM Cloud Starter Application`, I modified the `startNodeRED` function in `index.js` to never consider `config.adminAuth.allowAnonymous` or `process.env.NODE_RED_GUEST_ACCESS` (just by setting `if(false) ...`) - which does the trick, but is kinda hackish, so I'm still interested in learning how to apply this configuration via the NODE\_RED\_GUEST\_USER environment variable 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [19 August 2022 12:03 UTC](https://discourse.nodered.org/t/prevent-anonymous-editor-access-on-ibm-cloud-code-engine/64163/3 "2022-08-19T12:03:37Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.