# \#security

**URL:** https://discourse.nodered.org/tag/security/10.md?page=1

[Latest](https://discourse.nodered.org/latest.md) · [Categories](https://discourse.nodered.org/categories.md) · [Tags](https://discourse.nodered.org/tags.md)

**Page:** 2

---

## [NATS communication with credential file as authentification](https://discourse.nodered.org/t/nats-communication-with-credential-file-as-authentification/98266)

<div class="topic-metadata">

**Author:** [@KRR](https://discourse.nodered.org/u/KRR)\
**Replies:** 2\
**Last updated:** [24 July 2025 07:05 UTC](https://discourse.nodered.org/t/nats-communication-with-credential-file-as-authentification/98266 "2025-07-24T07:05:31Z")

</div>

In a project i have to use NATS communication. For the authentification on the NATS-server a credential file (based on JWT) is used. The credential file should be stored on the docker container of NodeRed. With currently…

---

## [Admin auth: password issue](https://discourse.nodered.org/t/admin-auth-password-issue/97815)

<div class="topic-metadata">

**Author:** [@mus-ab03](https://discourse.nodered.org/u/mus-ab03)\
**Replies:** 2\
**Last updated:** [29 June 2025 10:59 UTC](https://discourse.nodered.org/t/admin-auth-password-issue/97815 "2025-06-29T10:59:06Z")

</div>

I have node-red 4.0.9 running as a service using nssm, I set up the password using node-red-admin hash-pw. After a few days it seems that the password was changed automatically and I had to reset the password in settings…

---

## [Looking for consultants for Node-RED in financial services (Finshape is hiring)](https://discourse.nodered.org/t/looking-for-consultants-for-node-red-in-financial-services-finshape-is-hiring/84611)

<div class="topic-metadata">

**Author:** [@petrpko](https://discourse.nodered.org/u/petrpko)\
**Replies:** 8\
**Last updated:** [27 June 2025 08:24 UTC](https://discourse.nodered.org/t/looking-for-consultants-for-node-red-in-financial-services-finshape-is-hiring/84611 "2025-06-27T08:24:49Z")

</div>

Ive been personally using Node-RED for years. Its been so great technology and the community around it that I decided to use it also in business. We've been using Node-RED within our digital platform DBOS (Digital Bank O…

---

## [Node.js v18 is EOL, they are recommending users skip v20 - move to v22](https://discourse.nodered.org/t/node-js-v18-is-eol-they-are-recommending-users-skip-v20-move-to-v22/97536)

<div class="topic-metadata">

**Author:** [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Replies:** 0\
**Last updated:** [10 June 2025 19:10 UTC](https://discourse.nodered.org/t/node-js-v18-is-eol-they-are-recommending-users-skip-v20-move-to-v22/97536 "2025-06-10T19:10:27Z")

</div>

An interesting article from a core node.js dev and especially important for anyone using Node-RED commercially or on the Internet.

---

## [User permission scoped to a flow/tab in editor](https://discourse.nodered.org/t/user-permission-scoped-to-a-flow-tab-in-editor/97378)

<div class="topic-metadata">

**Author:** [@JpEncausse](https://discourse.nodered.org/u/JpEncausse)\
**Replies:** 0\
**Last updated:** [2 June 2025 10:12 UTC](https://discourse.nodered.org/t/user-permission-scoped-to-a-flow-tab-in-editor/97378 "2025-06-02T10:12:00Z")

</div>

Hello, I'd like to limite a Node-RED user permission to a subset of flow/tab in admin editor Context: I setup a kind of sandbox with a Setup Tab to init variables, and a Websocket Node for instance a User1 Tab that w…

---

## [Outdated node-red-dev](https://discourse.nodered.org/t/outdated-node-red-dev/97008)

<div class="topic-metadata">

**Author:** [@augjoh](https://discourse.nodered.org/u/augjoh)\
**Replies:** 1\
**Last updated:** [11 May 2025 08:40 UTC](https://discourse.nodered.org/t/outdated-node-red-dev/97008 "2025-05-11T08:40:20Z")

</div>

When installing the node-red-dev package npm audit fails. The package hasn't been touched in the last two years. Is it still supported? How can I work around the problems reported? npm audit --fix doesn't solve any issue…

---

## [Encrypting pi, without password on boot?](https://discourse.nodered.org/t/encrypting-pi-without-password-on-boot/96798)

<div class="topic-metadata">

**Author:** [@ThingsTinkerer](https://discourse.nodered.org/u/ThingsTinkerer)\
**Replies:** 7\
**Last updated:** [1 May 2025 22:56 UTC](https://discourse.nodered.org/t/encrypting-pi-without-password-on-boot/96798 "2025-05-01T22:56:21Z")

</div>

This is not exactly node red, but the community here is also awesome on related topics. If you use node red on pi, and have multiple such raspberry pis running on different customer sites. How to encrypt? Because if you…

---

## [How to find out the credentialSecret](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729)

<div class="topic-metadata">

**Author:** [@toony1906](https://discourse.nodered.org/u/toony1906)\
**Replies:** 6\
**Last updated:** [24 April 2025 09:51 UTC](https://discourse.nodered.org/t/how-to-find-out-the-credentialsecret/96729 "2025-04-24T09:51:08Z")

</div>

Hi everyone, I'm a bit new to Node Red and unfortunately I used a password in a config node which can't be reset and so I thought maybe I can decrypt the flows\_cred.json, for that I would need the credentialSecret. I ha…

---

## [Oauth/OpenId Login with Keycloak based on roles](https://discourse.nodered.org/t/oauth-openid-login-with-keycloak-based-on-roles/96690)

<div class="topic-metadata">

**Author:** [@sara-aziz](https://discourse.nodered.org/u/sara-aziz)\
**Replies:** 0\
**Last updated:** [21 April 2025 18:55 UTC](https://discourse.nodered.org/t/oauth-openid-login-with-keycloak-based-on-roles/96690 "2025-04-21T18:55:14Z")

</div>

Hi Everyone, I’m integrating Keycloak authentication into Node-RED using passport-keycloak-oauth2-oidc. The authentication flow is successful, and I can see the correct user profile and roles returned from Keycloak. How…

---

## [Tutorial - Secure your home automation - VPN - What is it? How do I use it?](https://discourse.nodered.org/t/tutorial-secure-your-home-automation-vpn-what-is-it-how-do-i-use-it/95921)

<div class="topic-metadata">

**Author:** [@mudwalker](https://discourse.nodered.org/u/mudwalker)\
**Replies:** 13\
**Last updated:** [20 March 2025 12:14 UTC](https://discourse.nodered.org/t/tutorial-secure-your-home-automation-vpn-what-is-it-how-do-i-use-it/95921 "2025-03-20T12:14:03Z")

</div>

I have been looking at the Tailscale configuration tutorial created by @BartButenaers, and also, previously configured Cloudflare Zero Trust to work on my devices/network with the encouragement of @TotallyInformation. Cl…

---

## [Node-RED - Keycloak - Self-signed certificate in certificate chain](https://discourse.nodered.org/t/node-red-keycloak-self-signed-certificate-in-certificate-chain/96089)

<div class="topic-metadata">

**Author:** [@Markus\_M](https://discourse.nodered.org/u/Markus_M)\
**Replies:** 5\
**Last updated:** [19 March 2025 11:55 UTC](https://discourse.nodered.org/t/node-red-keycloak-self-signed-certificate-in-certificate-chain/96089 "2025-03-19T11:55:57Z")

</div>

Hi guys, I have the same problem as described in this entry: Node-RED integration with Keycloak gives Error self signed certificate I used the environment variable (process.env.NODE\_TLS\_REJECT\_UNAUTHORIZED = "0") as w…

---

## [Node-Red Security](https://discourse.nodered.org/t/node-red-security/95858)

<div class="topic-metadata">

**Author:** [@WDL](https://discourse.nodered.org/u/WDL)\
**Replies:** 11\
**Last updated:** [12 March 2025 15:15 UTC](https://discourse.nodered.org/t/node-red-security/95858 "2025-03-12T15:15:45Z")

</div>

Hi, Have read a lot here about NR and security issues when deploying in the cloud. Have read that it is good to go and also that don't do it as commercially you are going to get issues. The security of NR in the cloud…

---

## [Ui iframe VPN access](https://discourse.nodered.org/t/ui-iframe-vpn-access/95854)

<div class="topic-metadata">

**Author:** [@Zwen](https://discourse.nodered.org/u/Zwen)\
**Replies:** 14\
**Last updated:** [12 March 2025 09:35 UTC](https://discourse.nodered.org/t/ui-iframe-vpn-access/95854 "2025-03-12T09:35:16Z")

</div>

Hello community, this may not be the most appropriate forum for the topic, but maybe someone can help me. I have a RaspberryPi running with NodeRed. I would like to use a ui-iframe to embed local web interfaces (e.g. a…

---

## [Configure Secure Node-Red basically](https://discourse.nodered.org/t/configure-secure-node-red-basically/95653)

<div class="topic-metadata">

**Author:** [@muksidin](https://discourse.nodered.org/u/muksidin)\
**Replies:** 7\
**Last updated:** [6 March 2025 14:50 UTC](https://discourse.nodered.org/t/configure-secure-node-red-basically/95653 "2025-03-06T14:50:07Z")

</div>

Hello, i am new in node-red. So for basic security, i imagine for node-red dashboard make public without password and for node-red editor make secured by enable user and password login. Is it possible to make this. Tha…

---

## [Nodered - safe connection](https://discourse.nodered.org/t/nodered-safe-connection/95181)

<div class="topic-metadata">

**Author:** [@John1995](https://discourse.nodered.org/u/John1995)\
**Replies:** 13\
**Last updated:** [22 February 2025 19:41 UTC](https://discourse.nodered.org/t/nodered-safe-connection/95181 "2025-02-22T19:41:58Z")

</div>

Hello, I installed nodered with Nodered Install and at certain point I saw this message at the end of the installation DO NOT EXPOSE NODE-RED TO THE OPEN INTERNET WITHOUT SECURING IT FIRST Even if your Node-RED doesn'…

---

## [Basic auth for dashboard 2 It stops working](https://discourse.nodered.org/t/basic-auth-for-dashboard-2-it-stops-working/95538)

<div class="topic-metadata">

**Author:** [@Pepex7](https://discourse.nodered.org/u/Pepex7)\
**Replies:** 7\
**Last updated:** [21 February 2025 22:41 UTC](https://discourse.nodered.org/t/basic-auth-for-dashboard-2-it-stops-working/95538 "2025-02-21T22:41:18Z")

</div>

I'm using basic auth for dashboard 2 (@aikitori/node-red-dashboard-2-basic-auth) but when I restart the server it stops working. in the console it says: node-red-dashboard-2-basic-auth: Dashboard interacted with…

---

## [When is it advisable to use https with tailscale?](https://discourse.nodered.org/t/when-is-it-advisable-to-use-https-with-tailscale/95251)

<div class="topic-metadata">

**Author:** [@Colin](https://discourse.nodered.org/u/Colin)\
**Replies:** 38\
**Last updated:** [19 February 2025 16:33 UTC](https://discourse.nodered.org/t/when-is-it-advisable-to-use-https-with-tailscale/95251 "2025-02-19T16:33:29Z")

</div>

I have been trying out Tailscale using @BartButenaers' most excellent tailscale tutorial and, with that tutorial, tailscale is remarkably simple to use. In the tutorial the use of https is advised. It is not clear to …

---

## [Issue with HTTP request auth](https://discourse.nodered.org/t/issue-with-http-request-auth/95497)

<div class="topic-metadata">

**Author:** [@BobS](https://discourse.nodered.org/u/BobS)\
**Replies:** 0\
**Last updated:** [18 February 2025 21:40 UTC](https://discourse.nodered.org/t/issue-with-http-request-auth/95497 "2025-02-18T21:40:09Z")

</div>

Good afternoon, I'm trying to do a http request/api call to be able to automate turning on and off flows. Following this Enable or disable a flow (tab) per flow name (flow) - Node-RED it works fine if I import the code…

---

## [Node-red with security padlock](https://discourse.nodered.org/t/node-red-with-security-padlock/95326)

<div class="topic-metadata">

**Author:** [@Erissin\_Industria4.0](https://discourse.nodered.org/u/Erissin_Industria4.0)\
**Replies:** 14\
**Last updated:** [11 February 2025 20:10 UTC](https://discourse.nodered.org/t/node-red-with-security-padlock/95326 "2025-02-11T20:10:43Z")

</div>

Hello gentlemen, I generated a certificate signed by myself to use node-red with https, but the site keeps showing the warning as not secure, do you know any way to remove this warning, and leave the site with a secure p…

---

## [Dynamic Variables](https://discourse.nodered.org/t/dynamic-variables/95221)

<div class="topic-metadata">

**Author:** [@leozanellato](https://discourse.nodered.org/u/leozanellato)\
**Replies:** 0\
**Last updated:** [7 February 2025 20:11 UTC](https://discourse.nodered.org/t/dynamic-variables/95221 "2025-02-07T20:11:08Z")

</div>

I'm working on a new project using ECS with Docker. Instead of using a cryptographic file, I'm storing credentials dynamically in flow\_creds.json by leveraging AWS Secrets Manager like: Server: {{{SQL\_IP}}} Password: {…

---

## [Configuring Keycloak with Node-RED in 2025](https://discourse.nodered.org/t/configuring-keycloak-with-node-red-in-2025/95070)

<div class="topic-metadata">

**Author:** [@theunfamousq](https://discourse.nodered.org/u/theunfamousq)\
**Replies:** 0\
**Last updated:** [2 February 2025 17:59 UTC](https://discourse.nodered.org/t/configuring-keycloak-with-node-red-in-2025/95070 "2025-02-02T17:59:11Z")

</div>

Hello everyone! I'm seeking help for a personal project: I'm trying to create a secured infrastructure, based on using Keycloak, to ease identification. I'm new to this kind of thing, and I would really appreciate some …

---

## [Serving dashboards on my local server to the internet](https://discourse.nodered.org/t/serving-dashboards-on-my-local-server-to-the-internet/94869)

<div class="topic-metadata">

**Author:** [@88bit](https://discourse.nodered.org/u/88bit)\
**Replies:** 4\
**Last updated:** [27 January 2025 10:29 UTC](https://discourse.nodered.org/t/serving-dashboards-on-my-local-server-to-the-internet/94869 "2025-01-27T10:29:14Z")

</div>

Hi all, I'm trying to help some friends with various monitoring needs. I'm using LoRaWAN devices connected to the TTN ( the Things network ). This is all working well and I'm using an MQTT input from the TTN to feed data…

---

## [How to configure Node Red OAuth against Gitea IDP OAuth Provider - ID token not issued](https://discourse.nodered.org/t/how-to-configure-node-red-oauth-against-gitea-idp-oauth-provider-id-token-not-issued/94853)

<div class="topic-metadata">

**Author:** [@mcook](https://discourse.nodered.org/u/mcook)\
**Replies:** 2\
**Last updated:** [23 January 2025 20:28 UTC](https://discourse.nodered.org/t/how-to-configure-node-red-oauth-against-gitea-idp-oauth-provider-id-token-not-issued/94853 "2025-01-23T20:28:25Z")

</div>

I have tried to follow a couple of sites about enabling "adminAuth" section in Node Red settings.js for a self-hosted Gitea instance. I use this as an IDP for a variety of other self-hosted tools. I am stuck. The flow…

---

## [Tailscale webinar](https://discourse.nodered.org/t/tailscale-webinar/94829)

<div class="topic-metadata">

**Author:** [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Replies:** 0\
**Last updated:** [22 January 2025 16:58 UTC](https://discourse.nodered.org/t/tailscale-webinar/94829 "2025-01-22T16:58:32Z")

</div>

Don't know how many users have followed @BartButenaers excellent blog about using Tailscale to increase the security of node-RED, but just seen that Tailscale are having a free webinar on 28th January, which may be of in…

---

## [Install Node Red On Secure Server](https://discourse.nodered.org/t/install-node-red-on-secure-server/94669)

<div class="topic-metadata">

**Author:** [@VaibhavPokharkar](https://discourse.nodered.org/u/VaibhavPokharkar)\
**Replies:** 4\
**Last updated:** [16 January 2025 15:04 UTC](https://discourse.nodered.org/t/install-node-red-on-secure-server/94669 "2025-01-16T15:04:04Z")

</div>

Hi, I am Trying To install Node Red on a our customer Server Where they have assigned us a Windows Server with full internet access using proxy from internet Browser. But When we are installing node red it downloads r…

---

## [Password for DB connection showing in syslog](https://discourse.nodered.org/t/password-for-db-connection-showing-in-syslog/94584)

<div class="topic-metadata">

**Author:** [@mattuns](https://discourse.nodered.org/u/mattuns)\
**Replies:** 6\
**Last updated:** [14 January 2025 09:24 UTC](https://discourse.nodered.org/t/password-for-db-connection-showing-in-syslog/94584 "2025-01-14T09:24:43Z")

</div>

Hi, While troubleshooting a server issue I noticed that the linux syslog (/var/log/messages) periodically shows the full connection details for our DB connections. I tried reducing the logging level but even when "off"…

---

## [Flowfuse authenticator](https://discourse.nodered.org/t/flowfuse-authenticator/94478)

<div class="topic-metadata">

**Author:** [@Quintijn](https://discourse.nodered.org/u/Quintijn)\
**Replies:** 4\
**Last updated:** [9 January 2025 11:12 UTC](https://discourse.nodered.org/t/flowfuse-authenticator/94478 "2025-01-09T11:12:33Z")

</div>

Hi All, New user here so still exploring lots of things on the dashboard 2.0. I'm currently testing to create a basic application in the dashboard. I'm using a flow fuse remote instance to build this. However, I have …

---

## [2FA on admin login screen](https://discourse.nodered.org/t/2fa-on-admin-login-screen/94375)

<div class="topic-metadata">

**Author:** [@Hans4711](https://discourse.nodered.org/u/Hans4711)\
**Replies:** 6\
**Last updated:** [6 January 2025 15:02 UTC](https://discourse.nodered.org/t/2fa-on-admin-login-screen/94375 "2025-01-06T15:02:00Z")

</div>

How to enable 2FA on admin login screen?

---

## [credentialSecret not applied when using projects](https://discourse.nodered.org/t/credentialsecret-not-applied-when-using-projects/94388)

<div class="topic-metadata">

**Author:** [@ThingsTinkerer](https://discourse.nodered.org/u/ThingsTinkerer)\
**Replies:** 2\
**Last updated:** [6 January 2025 10:39 UTC](https://discourse.nodered.org/t/credentialsecret-not-applied-when-using-projects/94388 "2025-01-06T10:39:33Z")

</div>

Got a Node Red running in docker with projects enabled. Originally I had credentialSecret: false in settings.js. But now I changed to a secret string (ie. credentialSecret: "a-secret-string). How to enable this? I thoug…

---

## [Anyone know what this is?](https://discourse.nodered.org/t/anyone-know-what-this-is/94242)

<div class="topic-metadata">

**Author:** [@Cathprotech](https://discourse.nodered.org/u/Cathprotech)\
**Replies:** 4\
**Last updated:** [6 January 2025 08:40 UTC](https://discourse.nodered.org/t/anyone-know-what-this-is/94242 "2025-01-06T08:40:21Z")

</div>

I have not used Node-Red for quite some time now and I noticed it was still running on my RPi4. I opened the web server page only to be greated with this: (Hopefull the image is below). First thing is, none of my fl…

[Previous page](https://discourse.nodered.org/tag/security/10.md?match_all_tags=true&tags%5B%5D=security)

[Next page](https://discourse.nodered.org/tag/security/10.md?match_all_tags=true&page=2&tags%5B%5D=security)