Current Behavior
When Node-RED is configured with basic authentication (credentials) defining users with read permissions versus full access (*), users with read-only permissions encounter misleading error messages and UI notifications when attempting write or administrative operations (such as creating/modifying projects or triggering nodes).
Instead of clearly stating that the logged-in user lacks the required write permissions for the action, Node-RED displays generic messages claiming the user is not logged in or throwing an unexpected 401 Unauthorized error—even though the user has successfully authenticated and is actively logged into the session.
Current Behavior (Observed):
Issue 1:
When a user logs in NODE-RED (When projects are enabled in settings) : A notification popup appears in the top banner stating:
You must be logged in to perform this action
Issue 2:
When creating a Project (New): A notification popup appears in the top banner stating:
You must be logged in to perform this action
Expected Behavior
Expected Behavior (Proposed):
Since the user is already authenticated and logged in, the UI error handling should distinguish between an unauthenticated session (no valid token/cookie) and an unauthorized action (insufficient permissions).
The application should provide precise, context-aware error messages indicating role/permission limits. For example:
For UI Notifications:
You must be logged in with (xyz) permissions in order to perform (xyz) action.
Example : You must be logged in with write permissions in order to create a project.
Steps To Reproduce
1.Configure settings.js with adminAuth supporting credentials with mixed permissions:
adminAuth: {
type: "credentials",
users: [{
username: "admin",
password: "...",
permissions: "*"
}, {
username: "user",
password: "...",
permissions: "read"
}],
default: {
permissions: "read"
}
}
2.Log into the Node-RED editor using the user account (which has read permissions).
3.Verify the top-right header shows the user is logged in (e.g., us avatar / Logged in as user).
4.Attempt to perform a restricted write action, such as:
- Clicking Menu > Projects > New.
Example flow
No response
Environment
- Node-RED version: v4.1.8
- Node.js version: v20.x LTS
- npm version: v10.x
- Platform/OS:
- Browser:
Current Behavior
When Node-RED is configured with basic authentication (credentials) defining users with read permissions versus full access (*), users with read-only permissions encounter misleading error messages and UI notifications when attempting write or administrative operations (such as creating/modifying projects or triggering nodes).
Instead of clearly stating that the logged-in user lacks the required write permissions for the action, Node-RED displays generic messages claiming the user is not logged in or throwing an unexpected 401 Unauthorized error—even though the user has successfully authenticated and is actively logged into the session.
Current Behavior (Observed):
Issue 1:
When a user logs in NODE-RED (When projects are enabled in settings) : A notification popup appears in the top banner stating:
You must be logged in to perform this action
Issue 2:
When creating a Project (New): A notification popup appears in the top banner stating:
You must be logged in to perform this action
Expected Behavior
Expected Behavior (Proposed):
Since the user is already authenticated and logged in, the UI error handling should distinguish between an unauthenticated session (no valid token/cookie) and an unauthorized action (insufficient permissions).
The application should provide precise, context-aware error messages indicating role/permission limits. For example:
For UI Notifications:
You must be logged in with (xyz) permissions in order to perform (xyz) action.
Example : You must be logged in with write permissions in order to create a project.
Steps To Reproduce
1.Configure settings.js with adminAuth supporting credentials with mixed permissions:
adminAuth: {
type: "credentials",
users: [{
username: "admin",
password: "...",
permissions: "*"
}, {
username: "user",
password: "...",
permissions: "read"
}],
default: {
permissions: "read"
}
}
2.Log into the Node-RED editor using the user account (which has read permissions).
3.Verify the top-right header shows the user is logged in (e.g., us avatar / Logged in as user).
4.Attempt to perform a restricted write action, such as:
- Clicking Menu > Projects > New.
Example flow
No response
Environment