# Unexpected flow restart with lost of context files & tokens (google and telegram)!

**URL:** <https://discourse.nodered.org/t/unexpected-flow-restart-with-lost-of-context-files-tokens-google-and-telegram/100104>\
**Category:** General\
**Tags:** security\
**Created:** [6 January 2026 17:17 UTC](https://discourse.nodered.org/t/unexpected-flow-restart-with-lost-of-context-files-tokens-google-and-telegram/100104 "2026-01-06T17:17:50Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [12 January 2026 10:59 UTC](https://discourse.nodered.org/t/unexpected-flow-restart-with-lost-of-context-files-tokens-google-and-telegram/100104/22 "2026-01-12T10:59:05Z")

</div>

Nope. Nor raspi-config.  
The Pi authorities have known about this since September but have not [been bothered to] fix it.

---

<div class="post-metadata">

**Author:** ![sebamelo](https://avatars.discourse-cdn.com/v4/letter/s/ee59a6/32.png) [@sebamelo](https://discourse.nodered.org/u/sebamelo)\
**Post date:** [12 January 2026 11:02 UTC](https://discourse.nodered.org/t/unexpected-flow-restart-with-lost-of-context-files-tokens-google-and-telegram/100104/23 "2026-01-12T11:02:36Z")

</div>

Even standard users need to login with a username and password to access the system, right?

Therefore I should have a trace in journalctl.

Am I wrong?

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [12 January 2026 11:20 UTC](https://discourse.nodered.org/t/unexpected-flow-restart-with-lost-of-context-files-tokens-google-and-telegram/100104/24 "2026-01-12T11:20:28Z")

</div>

When you connect to the node red editor on port 1880 does it log that in journalctl?

I use Cloudflare Zero Trust as suggested by totalyinformation so I don't know about the built in node red login system.

Also note that they only needed to get in once, possibly some time ago, to setup the cron job to keep messing with your flows.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [12 January 2026 11:50 UTC](https://discourse.nodered.org/t/unexpected-flow-restart-with-lost-of-context-files-tokens-google-and-telegram/100104/25 "2026-01-12T11:50:35Z")

</div>

It has been shown before that it is quite easy to do all sorts of things that you probably don't want "people" to do when using Node-RED. For example, there appears to be no way to prevent the settings.js being updated from Node-RED.

Basically, you cannot guarantee the full security of the Node-RED editor without some serious work as seen in the commercial FlowFuse offering for example. Node-RED is a very powerful tool and all too easy to misuse.

Having said that, some sensible precautions should be more than enough for most people.

If you need access to a Dashboard or UIBUILDER site from the Internet, use Cloudflare Zero Trust or something similar (unless you are part of an enterprise that has enterprise security tools already available).

If you need access to the Editor over the Internet - really ❓ Well, if you really insist (and I don't really recommend it), again use something like CFZT but on a separate link with separate security settings.

In all cases, if you can further limit access, Cloudflare offers some great tools even for free users. For example, limiting access to certain countries - not perfect but every little helps.

I generally leave access to my live server's Editor OFF. If I ever need it, I can turn it on from Cloudflare's admin portal. In the past, before CFZT came along, I used NGROK and also left that OFF with a telegram bot command that let me turn it on and off remotely.

Sadly, the Internet has become a battleground over the years and especially over the last few years where we have open digital warfare between countries. This hybrid warfare is not theoretical and not something that "happens to someone else". I'm afraid it is very real and present.

Thankfully, for most of use, again, some sensible precautions are about all we need.

PS: Anyone else been targeted with fake SMS messages recently? I've had a few, specifically Binance. They ask you to ring a number if the attempted login or sell instruction wasn't you. Stay sharp out there everyone! 🚨

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [12 January 2026 12:11 UTC](https://discourse.nodered.org/t/unexpected-flow-restart-with-lost-of-context-files-tokens-google-and-telegram/100104/26 "2026-01-12T12:11:36Z")

</div>

> [@TotallyInformation](#):
>
> there appears to be no way to prevent the settings.js being updated from Node-RED.

It can be done pretty easily.

1. Make the settings file immutable with `sudo chattr +i settings.js`
2. Disallow sudo for the Node-red user.

If you also make the flows file immutable I think Node-red still works but nobody can deploy changes, so it's effectively read-only.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [12 April 2026 12:11 UTC](https://discourse.nodered.org/t/unexpected-flow-restart-with-lost-of-context-files-tokens-google-and-telegram/100104/27 "2026-04-12T12:11:47Z")

</div>

Closed on 12 April 2026 12:11 UTC

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.

[Previous page](https://discourse.nodered.org/t/unexpected-flow-restart-with-lost-of-context-files-tokens-google-and-telegram/100104.md?page=1)