# Security, add more then one user

**URL:** <https://discourse.nodered.org/t/security-add-more-then-one-user/9141>\
**Category:** General\
**Created:** [18 March 2019 18:29 UTC](https://discourse.nodered.org/t/security-add-more-then-one-user/9141 "2019-03-18T18:29:34Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![pvklink](https://avatars.discourse-cdn.com/v4/letter/p/46a35a/32.png) [@pvklink](https://discourse.nodered.org/u/pvklink)\
**Post date:** [18 March 2019 18:29 UTC](https://discourse.nodered.org/t/security-add-more-then-one-user/9141/1 "2019-03-18T18:29:34Z")

</div>

Hi like to add more then one user to use the dashboard.  
So i edit the setting.js.  
It seems that only the last account/user is working, can there be only one user ?  
I want to have one user that i use to edit the dashboard and another user for using in IFTTT

```
// Securing Node-RED
// -----------------
// To password protect the Node-RED editor and admin API, the following
// property can be used. See http://nodered.org/docs/security.html for details.
adminAuth: {
    type: "credentials",
    users: [{
        username: "admin",
        password: "<my_hash1>",
        permissions: "*",
        username: "api-user",
        password: "<my_hash2>",
        permissions: "read"
    }]
},
```

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [18 March 2019 20:08 UTC](https://discourse.nodered.org/t/security-add-more-then-one-user/9141/2 "2019-03-18T20:08:11Z")

</div>

Hi @pvklink - you haven't quite got the syntax right. The `users` property is meant to be an array of user objects:

```auto
   users: [{
        username: "admin",
        password: "<my_hash1>",
        permissions: "*"
   }, {
        username: "api-user",
        password: "<my_hash2>",
        permissions: "read"
    }]

```

---

<div class="post-metadata">

**Author:** ![pvklink](https://avatars.discourse-cdn.com/v4/letter/p/46a35a/32.png) [@pvklink](https://discourse.nodered.org/u/pvklink)\
**Post date:** [18 March 2019 22:05 UTC](https://discourse.nodered.org/t/security-add-more-then-one-user/9141/3 "2019-03-18T22:05:27Z")

</div>

thanks @knolleary

---

<div class="post-metadata">

**Author:** ![pvklink](https://avatars.discourse-cdn.com/v4/letter/p/46a35a/32.png) [@pvklink](https://discourse.nodered.org/u/pvklink)\
**Post date:** [19 March 2019 09:30 UTC](https://discourse.nodered.org/t/security-add-more-then-one-user/9141/4 "2019-03-19T09:30:25Z")

</div>

OK, my dashboard seems to work now with two accounts (one readonly) and ssl, so much secure!  
But, my webhook in IFTTT does not use this settings and is not secure!  
I tested my IFTTT webhook:  
https://:@router..nl:1880/pvkapi it works, but:  
[https://router](https://router)..nl:1880/pvkapi also works!

post (body)  
{"command":"switchlight", "idx": 354, "switchcmd": "Set Level","level": 40}

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [19 March 2019 10:35 UTC](https://discourse.nodered.org/t/security-add-more-then-one-user/9141/5 "2019-03-19T10:35:39Z")

</div>

adminAuth only secures the editor. It does not secure the routes you define with the HTTP nodes.

We only support basic auth on those routes - the security docs page tells you how to configure it.

---

<div class="post-metadata">

**Author:** ![pvklink](https://avatars.discourse-cdn.com/v4/letter/p/46a35a/32.png) [@pvklink](https://discourse.nodered.org/u/pvklink)\
**Post date:** [19 March 2019 10:53 UTC](https://discourse.nodered.org/t/security-add-more-then-one-user/9141/6 "2019-03-19T10:53:42Z")

</div>

I also set  
httpNodeAuth: {user:"api-user",pass:"xxx"},  
httpStaticAuth: {user:"api-user",pass:"xxxx"},

but still i can add http post and get requests in IFTTT without username and password

---

<div class="post-metadata">

**Author:** ![pvklink](https://avatars.discourse-cdn.com/v4/letter/p/46a35a/32.png) [@pvklink](https://discourse.nodered.org/u/pvklink)\
**Post date:** [19 March 2019 17:14 UTC](https://discourse.nodered.org/t/security-add-more-then-one-user/9141/7 "2019-03-19T17:14:38Z")

</div>

problem solved... reboot did the trick