# Template node does not load img tag with basic auth

**URL:** <https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660>\
**Category:** Dashboard\
**Created:** [3 December 2024 12:27 UTC](https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660 "2024-12-03T12:27:34Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sirhc](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@Sirhc](https://discourse.nodered.org/u/Sirhc)\
**Post date:** [3 December 2024 12:27 UTC](https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660/1 "2024-12-03T12:27:34Z")

</div>

Hello

I have a template node in my flow. Within the template node I have a

\<img src="username:password@url\_here", id="x", width="300", height="300"\>

This used to work fine until I updated both NR and IOS on my ipad which is used to view the dashboard. Now when I go into the dashboard it just shows a blank box (i.e. the img tag is not loading the URL).

Does anyone know if this is no longer possible using the latest NR? Or is this no longer possible with the latest version of IOS?

Is there any way to diagnose in the inspect viewer why the URL is not loading?

---

<div class="post-metadata">

**Author:** ![zenofmud](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/zenofmud/32/316_2.png) [@zenofmud](https://discourse.nodered.org/u/zenofmud)\
**Post date:** [3 December 2024 13:41 UTC](https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660/2 "2024-12-03T13:41:47Z")

</div>

Are you using dashboard 1 or dashboard 2?  
Can you supply a small example flow demonstrating the issue?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [3 December 2024 14:13 UTC](https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660/3 "2024-12-03T14:13:53Z")

</div>

> [@Sirhc](#):
>
> \<img src="username:password@url\_here", id="x", width="300", height="300"\>

This is, of course, highly insecure so I hope that the id/password you use is not important and not used anywhere else.

---

<div class="post-metadata">

**Author:** ![Sirhc](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@Sirhc](https://discourse.nodered.org/u/Sirhc)\
**Post date:** [4 December 2024 08:41 UTC](https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660/4 "2024-12-04T08:41:57Z")

</div>

Thanks for the reply

I think it’s because the dashboard is setup for https and the url in the img src tag is http and being blocked by the browser?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [4 December 2024 10:55 UTC](https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660/5 "2024-12-04T10:55:36Z")

</div>

> [@Sirhc](#):
>
> I think it’s because the dashboard is setup for https and the url in the img src tag is http and being blocked by the browser?

Even with https, passing the id and password in the url is insecure since intermediate proxies can and do record it. It may be that you can guarantee that there will not be any proxies in your setup but that is a very fragile assumption and you may still get the id/password recorded in logs.

---

<div class="post-metadata">

**Author:** ![Sirhc](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@Sirhc](https://discourse.nodered.org/u/Sirhc)\
**Post date:** [4 December 2024 21:12 UTC](https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660/6 "2024-12-04T21:12:34Z")

</div>

Good point, but I am not sure how else to store the username/password to pass through? Is there a go-by or something I can read up on in order to make the installation more secure?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [4 December 2024 21:35 UTC](https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660/7 "2024-12-04T21:35:31Z")

</div>

Where is that image? Is it on a server that you have to log into? Does the login give you a token on login?

---

<div class="post-metadata">

**Author:** ![Sirhc](https://avatars.discourse-cdn.com/v4/letter/s/b77776/32.png) [@Sirhc](https://discourse.nodered.org/u/Sirhc)\
**Post date:** [5 December 2024 09:51 UTC](https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660/8 "2024-12-05T09:51:22Z")

</div>

It's okay I deleted the img src tag from the dashboard and found a way to use digest auth via a http request node. Thanks for the help all

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [4 January 2025 09:51 UTC](https://discourse.nodered.org/t/template-node-does-not-load-img-tag-with-basic-auth/93660/9 "2025-01-04T09:51:31Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.