Node-RED adminAuth and httpNodeAuth credentials lack native expiry or revocation

Authentication Constraints in Node-RED

Node-RED does not natively support a unified credential store between the editor and HTTP endpoints, nor does it provide granular token revocation or role-based access control (RBAC) for individual flows.

Direct Answers to Constraints

• Shared Credential Store: No. adminAuth (Editor/API) and httpNodeAuth (HTTP-in nodes) operate as independent mechanisms. Authenticating into the editor does not grant access to endpoints protected by httpNodeAuth.
• Token Revocation: No. There is no supported method to revoke a single adminAuth token without changing the global secret in settings.js, which invalidates all active sessions and requires a runtime restart.
• Role-Based Access Control: No. Node-RED does not provide native RBAC for specific nodes or flows. Access to the editor is binary: a user is either authenticated or they are not.

Technical Explanation

The adminAuth system relies on a static secret to sign tokens. Because these tokens are stateless and the secret is loaded at startup, the runtime cannot "blacklist" a specific token without changing the key used to validate all tokens. Similarly, httpNodeAuth is a middleware layer specifically for the HTTP-in node, separate from the session management used by the admin editor.

Recommended Resolution: External Proxy

To achieve least-privilege access, token expiry, and unified authentication without restarting the runtime, move the authentication boundary outside of Node-RED using a reverse proxy (e.g., NGINX, Traefik, or OAuth2 Proxy).

1. Disable Internal Auth: Remove adminAuth and httpNodeAuth from settings.js.
2. Implement Proxy Auth: Configure the proxy to handle OIDC or JWT validation.
3. Route-Based Access: Use the proxy to define different access rules for the editor path (/) and the API/HTTP endpoints (/api or custom paths).

Verification Steps

To confirm the current behavior in your environment (applicable to versions 1.x through 3.x):

• Verify Isolation: Log into the Node-RED editor, then attempt to access an http-in node protected by httpNodeAuth. You should be prompted for credentials again, confirming the lack of shared state.
• Verify Restart Requirement: Modify a password hash in settings.js and attempt to access the editor. The change will not take effect until the Node-RED process is restarted.

Diagnostic Note: Please specify if you are using a managed Node-RED distribution (e.g., FlowForge/FlowFuse), as these platforms provide an external management layer that overrides these core runtime limitations.