I have come to beg for a beginners guide to securing Node-Red which has dashboard elements and is open to the internet. Setting adminAuth & httpNodeAuth as described in Security is ok, though I had to sudo npm i bcryptjs. But How-to-safely-expose-Node-RED-to-the-Internet says Please don't forget …

[image] TotallyInformation: There has been mention of Passport.js ? I really need to stress here... Passport.js is there for users who want to do some sort of custom authentication mechanism. Node-REDs built-in adminAuth configuration is more than enough for most users and they don't have to…

[image] knolleary: also upgraded to be encrypted, the authentication mechanism wasn't extended to websockets That simply isn't true. If you have adminAuth set, then any editor websocket connection must go through an application-level exchange to prove it has a valid authentication token befo…

@TotallyInformation , I appreciate your responses, thanks. [image] TotallyInformation: It's just that the page linked to in the big blue banner at the top of every page in turn refers to your script. ?? What page is that? Documentation-Security [image] TotallyInformation: Raising an i…

I've taken some Sunday afternoon time to start an article. Not sure when it will get finished but feel free to use the comments to make sure I include the things you want to see. [image] How to secure Node-RED Node-RED is increasingly used in situations that require reasonable security.…

[image] jbudd: [image] TotallyInformation: It's just that the page linked to in the big blue banner at the top of every page in turn refers to your script. ?? What page is that? Documentation-Security Sorry, I can't see a blue banner, not sure what is generating that? This is what I …

Hi @TotallyInformation , I became interested in this discussion after assuming I could just secure Node-RED with a username and password, restrict it to HTTPS only and create a cert, then publish the page through the firewall. After reading this page (I believe you wrote this too) about how to secure…

[image] hazymat: . I know this page is a year old now, but the way I read it, because of the section on web sockets, I can't just secure it by HTTPS and use NR's built-in authentication. At least not without quite a bit of effort and future maintenance. That is not correct. If you enable admi…

[image] hazymat: It strikes me that I can do away with all the stress and bother of keeping things perfectly up-to-date My Cloudflare TLS certificate is valid until 2031, should I start worrying any time soon? Expiration Note that by default, newly generated certificates are valid for 15 ye…

Wow, lots of questions! [image] hazymat: After reading this page (I believe you wrote this too) about how to secure Node-RED, it basically scared me off quick smart. OK, so you are showing some real smarts now! :smile: The point is to be a bit shocked into thinking. So you've made it past t…

Node-RED

Node-RED Forum

Securing Node-Red

General

knolleary 30 September 2018 22:40 13

The blue banner is on the forum pages - I pinned my post about the issue as a banner so everyone would see it. You may have already dismissed it.

Topic		Replies	Views
Safely accessing Node-RED over the Internet FAQs security	21	7200	18 May 2023
Dashboard suddenly asks for password (Hacked Node-RED servers) General security	128	4459	4 December 2022
Configuring Public Node-RED Server on RPi General	29	1756	23 July 2020
How to deploy Node-red to the internet? General	12	621	5 May 2021
Remote Access for my dashboard Dashboard	38	16968	18 October 2024

Copyright OpenJS Foundation and Node-RED contributors. All rights reserved. The OpenJS Foundation has registered trademarks and uses trademarks. For a list of trademarks of the OpenJS Foundation, please see our Trademark Policy and Trademark List. Trademarks and logos not indicated on the list of OpenJS Foundation trademarks are trademarks™ or registered® trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Securing Node-Red

Related topics