# Request refresh via API - recheck

**URL:** <https://discourse.nodered.org/t/request-refresh-via-api-recheck/52804>\
**Category:** Feature Requests\
**Created:** [27 October 2021 07:24 UTC](https://discourse.nodered.org/t/request-refresh-via-api-recheck/52804 "2021-10-27T07:24:44Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![RaimondB](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/raimondb/32/3903_2.png) [@RaimondB](https://discourse.nodered.org/u/RaimondB)\
**Post date:** [19 November 2021 09:35 UTC](https://discourse.nodered.org/t/request-refresh-via-api-recheck/52804/3 "2021-11-19T09:35:03Z")

</div>

I have a working solution now that performs a github based login and uses the csrf for a refresh. Also I found somebody else with the same problem and a similar solution: [Automate updating nodes to the Flow Library - Creating Nodes - Node-RED Forum (nodered.org)](https://discourse.nodered.org/t/automate-updating-nodes-to-the-flow-library/46869/7)

Interestingly, he is not using a login at all. Not requiring a login seems to be a security issue to me?

Also, during the automation of the refresh, I stumbled upon the fact that the redirect\_uri that is used for the callback to the node-red site is http and not https.  
Is this on purpose? I would expect the whole login flow to be https based to prevent man-in-the-middle attacks. So I see a security risk there as well.

---

_[View the full topic](https://discourse.nodered.org/t/request-refresh-via-api-recheck/52804)._