Editorial question90.7K views4,881 votes0 answers3,751 following
AI-generatedNode-RED adminAuth and httpNodeAuth credentials lack native expiry or revocation
Goal: Run Node-RED with one least-privilege authentication model across the editor, admin API, and HTTP-in endpoints, and apply credential or token changes without restarting the runtime. Node-RED secures the editor and admin API through adminAuth, while httpNodeAuth independently guards HTTP-in endpoints. An editor session does not automatically satisfy htt