# Securing Node Red API

**URL:** <https://discourse.nodered.org/t/securing-node-red-api/93324>\
**Category:** General\
**Created:** [21 November 2024 20:50 UTC](https://discourse.nodered.org/t/securing-node-red-api/93324 "2024-11-21T20:50:22Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jaredlgeorge](https://avatars.discourse-cdn.com/v4/letter/j/8e7dd6/32.png) [@jaredlgeorge](https://discourse.nodered.org/u/jaredlgeorge)\
**Post date:** [21 November 2024 20:50 UTC](https://discourse.nodered.org/t/securing-node-red-api/93324/1 "2024-11-21T20:50:22Z")

</div>

I am creating an api to communicate from an iis webpage to node red and back to the page. I have a http in and a http out node. I am wanting to secure this api from unauthorized get request. Any suggestions on where I should start?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [21 November 2024 20:57 UTC](https://discourse.nodered.org/t/securing-node-red-api/93324/2 "2024-11-21T20:57:00Z")

</div>

How/where are you running Node-RED? Is that also running on a Windows server with IIS? Because if so, there is a proxy tool that Microsoft use on Azure web services that you can use anywhere that integrates running Node-RED with IIS and opens up the ability to secure access using AD/AAD.

Generally, proxies are the most comprehensive way to secure things. Not only does it keep your Node-RED configuration simpler but you tend to get far more options and options that may be more battle-tested as well. Certainly, they will be more performant.

---

<div class="post-metadata">

**Author:** ![jaredlgeorge](https://avatars.discourse-cdn.com/v4/letter/j/8e7dd6/32.png) [@jaredlgeorge](https://discourse.nodered.org/u/jaredlgeorge)\
**Post date:** [21 November 2024 21:04 UTC](https://discourse.nodered.org/t/securing-node-red-api/93324/3 "2024-11-21T21:04:16Z")

</div>

Node red is currently on ubuntu vm machine and iis is on its own server. We are planning on using url rewrite to access node red from the outside.

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/9/5/95fa9c3f7bffd3a9f276034711188ad089ca49d9.png)

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [21 November 2024 21:11 UTC](https://discourse.nodered.org/t/securing-node-red-api/93324/4 "2024-11-21T21:11:45Z")

</div>

I would strongly recommend the use of a proxy server then. Something like NGINX, Caddy, or HAProxy with a suitable identity and access management integration. Especially if you are operating in an enterprise environment where you may already have an existing IdM setup.

---

<div class="post-metadata">

**Author:** ![jaredlgeorge](https://avatars.discourse-cdn.com/v4/letter/j/8e7dd6/32.png) [@jaredlgeorge](https://discourse.nodered.org/u/jaredlgeorge)\
**Post date:** [21 November 2024 21:50 UTC](https://discourse.nodered.org/t/securing-node-red-api/93324/5 "2024-11-21T21:50:58Z")

</div>

Is there not a way I could just pass a token?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [19 February 2025 21:51 UTC](https://discourse.nodered.org/t/securing-node-red-api/93324/6 "2025-02-19T21:51:39Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.