Node-RED Admin API /flows Endpoint Permission Check Missing When adminAuth Disabled

Answer

When adminAuth is disabled, Node‑RED does not attach its built‑in authentication middleware to the admin HTTP routes. The /flows endpoint remains registered and will respond with a 200 OK (returning the flow JSON) to any request that can reach the instance. No explicit 401 is generated, and deployment failures are logged only as a generic “Error: Failed to deploy flow”.

Likely explanation

The admin API routes are added unconditionally; the authentication check is wrapped around them only when adminAuth evaluates to a truthy value (username/password, strategy, or false with a custom middleware). Setting adminAuth: false or commenting it out removes that wrapper, leaving the route open.

Confirmed facts

• The adminAuth setting in settings.js controls whether the built‑in auth middleware is applied to all admin endpoints (including /flows).
• When adminAuth is disabled, the middleware is skipped, so the route is accessible without credentials.
• Node‑RED’s documentation states that the admin API is “only active when adminAuth is configured”; disabling it removes the auth check but leaves the route registered.
• Enabling adminAuth (or providing external middleware that returns 401) restricts access and results in a 401 Unauthorized response for unauthenticated requests.

Steps to verify the behavior

1. Start Node‑RED with adminAuth commented out or set to false in settings.js.
2. From a host that can reach the instance, run:

   curl -v http://<host>:1880/admin/flows
   

3. Observe a 200 response and the flow JSON in the body.
4. Enable adminAuth (e.g., add a username/password block) and restart Node‑RED.
5. Repeat the same curl request; you should now receive a 401 Unauthorized unless you provide valid credentials (e.g., -u user:pass).
6. Check the Node‑RED log for lines such as "Admin API enabled" or "Admin API disabled" to confirm the setting’s state.

Recommendation

To obtain reliable deployment diagnostics and prevent unintended exposure of flow logic:

• Enable adminAuth (username/password, LDAP, OAuth strategy, etc.) so that the admin API returns a clear 401 when credentials are missing.
• If you prefer to keep the admin API open for internal tooling, place an external reverse‑proxy or middleware that enforces authentication and logs authentication‑specific failures.
• Ensure flow credentials are protected via credentialsSecret or by keeping the Node‑RED instance on a trusted network, as the /flows endpoint can disclose credentials when they are not encrypted.

One missing detail that could affect the recommendation: Are your flows storing sensitive credentials (e.g., API keys, passwords) that rely on credentialsSecret for encryption? Knowing this helps decide whether enabling adminAuth is sufficient or if additional credential encryption is also required.