# sessionExpiryTime for UI interface

**URL:** <https://discourse.nodered.org/t/sessionexpirytime-for-ui-interface/53075>\
**Category:** General\
**Tags:** security\
**Created:** [1 November 2021 15:08 UTC](https://discourse.nodered.org/t/sessionexpirytime-for-ui-interface/53075 "2021-11-01T15:08:12Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![ffich](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ffich/32/27292_2.png) [@ffich](https://discourse.nodered.org/u/ffich)\
**Post date:** [1 November 2021 15:08 UTC](https://discourse.nodered.org/t/sessionexpirytime-for-ui-interface/53075/1 "2021-11-01T15:08:12Z")

</div>

Hi,  
is there a way for changing the session expiry time for the UI in NR 2.x?. The sessionExpiryTime option works perfectly fine for the editor interface, but I've noticed it does not affect the UI (or either I'm not using it properly).

BR  
F.

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [1 November 2021 15:31 UTC](https://discourse.nodered.org/t/sessionexpirytime-for-ui-interface/53075/2 "2021-11-01T15:31:54Z")

</div>

By UI do you mean node-red-dashboard?

The only auth option we provide for that is by using `httpNodeAuth`. It doesn't provide any session expiry options.

---

<div class="post-metadata">

**Author:** ![ffich](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ffich/32/27292_2.png) [@ffich](https://discourse.nodered.org/u/ffich)\
**Post date:** [1 November 2021 15:43 UTC](https://discourse.nodered.org/t/sessionexpirytime-for-ui-interface/53075/3 "2021-11-01T15:43:08Z")

</div>

Yes, I mean the dashboard. Ok, thanks Nick 😁

---

<div class="post-metadata">

**Author:** ![ffich](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ffich/32/27292_2.png) [@ffich](https://discourse.nodered.org/u/ffich)\
**Post date:** [1 November 2021 15:46 UTC](https://discourse.nodered.org/t/sessionexpirytime-for-ui-interface/53075/4 "2021-11-01T15:46:20Z")

</div>

I also noticed that the dashboard session tokens seems to be not registered in the session JSON fine, so as far I understand, once a client is authenticated its dashboard token never expires, is this correct?

---

<div class="post-metadata">

**Author:** ![knolleary](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/knolleary/32/3_2.png) [@knolleary](https://discourse.nodered.org/u/knolleary)\
**Post date:** [1 November 2021 15:54 UTC](https://discourse.nodered.org/t/sessionexpirytime-for-ui-interface/53075/5 "2021-11-01T15:54:51Z")

</div>

That is correct. `httpNodeAuth` is a very crude authentication mechanism that only provides basic authentication with a single hardcoded username/password.

---

<div class="post-metadata">

**Author:** ![ffich](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/ffich/32/27292_2.png) [@ffich](https://discourse.nodered.org/u/ffich)\
**Post date:** [1 November 2021 16:14 UTC](https://discourse.nodered.org/t/sessionexpirytime-for-ui-interface/53075/6 "2021-11-01T16:14:55Z")

</div>

Thanks Nick 👍

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [1 November 2021 16:43 UTC](https://discourse.nodered.org/t/sessionexpirytime-for-ui-interface/53075/7 "2021-11-01T16:43:19Z")

</div>

You can always look at using a reverse proxy to provide your front-end security.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [31 December 2021 16:43 UTC](https://discourse.nodered.org/t/sessionexpirytime-for-ui-interface/53075/8 "2021-12-31T16:43:44Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.