# Uibuilder uibindex not working
**URL:** https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116
**Category:** Dashboard
**Tags:** uibuilder
**Created:** [23 February 2020 06:23 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116 "2020-02-23T06:23:22Z")
**Posts on this page:** 13
**Page:** 2
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [27 February 2020 17:03 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/21 "2020-02-27T17:03:48Z")
Oh dear, it gets worse.
If you use:
```auto
permissions: ['*'],
```
That doesn't work either. And neither does:
```auto
permissions: ['*','uibuilder.read'],
```
From [here](https://nodered.org/docs/user-guide/runtime/securing-node-red#user-permissions):
> From Node-RED 0.14 the permissions can be much finer grained and to support that, the property can either be a single string as before, or an array containing multiple permissions.
So I think that last one should have worked?
The following _does_ however work which again illustrates (I think) inconsistent behaviour:
```auto
default: {
permissions: ['*'],
},
```
This also works:
```auto
default: {
permissions: ['uibuilder.read'],
},
```
* * *
**So for now, the workaround is to include a default that incorporates either `*`, `read` or `uibuilder.read` depending on your security needs for the Editor interface.**
---
### Author:  [@stanleyseow](https://discourse.nodered.org/u/stanleyseow)
#### Post date: [28 February 2020 03:47 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/22 "2020-02-28T03:47:48Z")
Ok this works...
> [@TotallyInformation](#):
>
> default: { permissions: ['uibuilder.read'], },
---
### Author:  [@cflurin](https://discourse.nodered.org/u/cflurin)
#### Post date: [28 February 2020 06:15 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/23 "2020-02-28T06:15:33Z")
I'm wondering why this works for you:
```auto
default: { permissions: ['uibuilder.read'], },
```
but this doesn't:
```auto
default: {
permissions: "uibuilder.read"
}
```
See also the Node-Red doc:
[Securing Node-RED](https://nodered.org/docs/user-guide/runtime/securing-node-red)
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [28 February 2020 08:45 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/24 "2020-02-28T08:45:13Z")
Both _should_ work. I didn't have time to test that last one yesterday. But then `read` also works as default but not for a specific user so who knows what is actually happening.
---
### Author:  [@cflurin](https://discourse.nodered.org/u/cflurin)
#### Post date: [28 February 2020 08:49 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/25 "2020-02-28T08:49:26Z")
> [@TotallyInformation](#):
>
> Both _should_ work.
I think we should follow the doc, why did you use the square parentheses?
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [28 February 2020 08:54 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/26 "2020-02-28T08:54:56Z")
If you read the docs, it says that both a string and an array of strings are both allowed.
That is critical for fine-grained control since you are likely to want to pass several authorisation strings. If you couldn't do that, there would be no point at all in allowing things like `uibuilder.read` since only 1 node would ever be able to be authorised.
---
### Author:  [@cflurin](https://discourse.nodered.org/u/cflurin)
#### Post date: [28 February 2020 09:04 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/27 "2020-02-28T09:04:28Z")
> [@TotallyInformation](#):
>
> If you read the docs, it says that both a string and an array of strings are both allowed.
Right, but in this case there is only one permission, so I wouldn't use an array.
---
### Author:  [@stanleyseow](https://discourse.nodered.org/u/stanleyseow)
#### Post date: [28 February 2020 09:18 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/28 "2020-02-28T09:18:16Z")
I hv two identical setup, one on port 1881 and another on port 1882. Both running local copy of uibuilder but shared the node-red on global ...
The setting above works on 1881 ( uibindex ) but the same settings does not work on 1882
What other ways to get info on uibuilder ( logs / text output /etc ) besides uibindex ??
Thanks
---
### Author:  [@PeterH](https://discourse.nodered.org/u/PeterH)
#### Post date: [28 February 2020 09:42 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/29 "2020-02-28T09:42:23Z")
Just FYI:
There is also a quite serious side effect by setting the permissions on _default_ . Credentials/login are bypassed completely i.e. one does not need to pass any credential to get the _default_ permission.
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [28 February 2020 12:18 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/30 "2020-02-28T12:18:15Z")
So you are saying that you have 2 otherwise identical instances of Node-RED with the only difference being the port used and one instance uses the workaround authorisation settings correctly and the other does not?
That would surely be a bug in Node-RED that needs reporting?
Or have I missed something?
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [28 February 2020 12:24 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/31 "2020-02-28T12:24:18Z")
Yes Peter, that is certainly true. None of this is ideal I'm afraid.
As things stand and with what we know so far, I _think_ that there is an inconsistency with the way that Node-RED treats user-specific and default authorisation settings. Such that the assumptions about how to secure additional API's attached to the Editor's instance of the ExpressJS app server do not appear to be correct.
But I am reluctant to start raising issues against Node-RED without supporting evidence (e.g. I want to make sure it isn't just me doing or thinking something daft).
I think that we need some input from @knolleary or @dceejay at this point before I start considering other changes to uibuilder.
As things stand, I suspect that I need to change the uibindex authorisation from `uibuilder.read` to `read`. Though obviously, that gives less fine-grained control. But I would like additional input before making that change since it reduces the level of control you get over who can see the uibindex page.
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [28 February 2020 16:58 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/32 "2020-02-28T16:58:23Z")
> [@stanleyseow](#):
>
> What other ways to get info on uibuilder ( logs / text output /etc ) besides uibindex ??
Sorry, didn't answer that earlier.
Well, there _is_ a middleware function available so it is theoretically possible to abuse that in order to extract the same data that uibindex shows you.
Truthfully though, it would probably be easier to temporarily hack the source code. The simplest thing to do would be to copy the `RED.httpAdmin.get('/uibindex'` function (in `~/.node-red/node_modules/node-red-contrib-uibuilder/nodes/uibuilder.js`, give the URL a slightly different name, remove the `RED.auth.needsPermission('uibuilder.read')` (or replace it with something that works for your adminAuth configuration and then add a simple test at the top of your copied function that checks for a source IP address or possibly a URL parameter that only you know.
That wouldn't be massively secure but it would be enough to keep your users out and should be fine as long as you don't leave it in place too long.
Definitely the easiest way since it means you don't have to learn what the various variables do and why. Though if you really do want to learn that, you will find partial information on the internals in the docs folder - I recommend looking at the `security` branch if you want to do that since the docs are significantly improved (though still not complete by any means).
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [29 March 2020 16:58 UTC](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116/33 "2020-03-29T16:58:25Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
[Previous page](https://discourse.nodered.org/t/uibuilder-uibindex-not-working/22116.md?page=1)