Safety

Allowed servers

Without a limit, any valid server address in a message makes the Node-RED host open a connection to that address. To limit the servers, fill in the setting Allowed servers (under More options). Empty, the default, means any server.

Write one rule on each line. A comma or a semicolon also separates two rules. A line that starts with # is a comment.

Rule	Allows
line-b	the host line-b, any port
line-b:4840	the host line-b, port 4840 only
*.plant.local	a.plant.local, but not a.b.plant.local, any port
line-*	line-b, but not line-x.evil.com, any port
10.0.*	the IPv4 addresses that start with 10.0., no name, any port
line-*:*	the same hosts as line-*. * as the port means any port
*	any host

• A * in a part of a name means any characters except a dot. So *.plant.local means one part of a name before .plant.local.
• A rule made of digits and * is an IPv4 rule. It allows IPv4 addresses only. A * at the end means all the octets that are left: 10.0.* allows 10.0.5.7.
• The node compares names as text. It never looks up a name. A rule on a name does not check the IP address behind the name.
• Upper case and lower case are the same. The node ignores a scheme (opc.tcp://) and a path.
• A host is a name or an IPv4 address. A line with a user name, an IPv6 address or a bad port is not a rule.
• A line that is not a rule matches no server, and the node warns at deploy. A list with only such lines is active: it refuses every server except the server of the endpoint. So a typing mistake cannot allow all servers.
• The server of the endpoint (the same host and port) is always allowed. So Reset always works.
• Connect, Check and Let the message decide check the server address against the rules first. This includes the server address of the dialog. The check comes before any network access: no ping, no GetEndpoints, no name lookup.
• A server address that no rule allows gets an error message on endpoint. It names the setting and the number of rules. The running session stays.
• The dialog warns when its own server address is not in the list.
• A message cannot set or change the list. Get the settings tells if a list is active (allowlist.active). It tells nothing about the rules.

Trust of a new server

The Certificate Manager makes the trust decisions: it lists, trusts, rejects and removes certificates. A message never makes these decisions.

But by default, the node trusts a new server on the first connection. It saves the certificate of the server in the PKI (the folder of the trusted certificates). This is the same for an endpoint that you set in the editor. So a message that points the endpoint to a new server makes the certificate of that server trusted.

To limit the servers that a message can reach, use Allowed servers. A strict mode, which accepts only servers that are already trusted, is planned.

The licence

Connect and Reset change the connection of a running flow. They need a Professional licence.

• Without it, they get an error message on licence on output 2. The status of the node names the licence. The running session does not change.
• Check, Get the settings, Get the status and Disconnect work with every licence. So you can always look at an endpoint, and close it, even when the licence is missing, lower or expired.
• When the licence ends while the flow runs, the open session stays. Only the next Connect or Reset is refused.

Secrets stay in memory

• The settings of the messages live in memory. After a deploy or a restart, the endpoint uses its own settings again.
• The node never writes a password to a log or to an output.
• The node always shows a server address without a user name and a password.
• A server address of the endpoint with a user name or a password in it is refused by Connect, Check and Reset. Use userName and password. The client nodes pass the address on without them.
• Everything in an output is a copy. A node after this node cannot change the settings.

See also The password and the certificate.

What a message cannot change

These settings are fixed. A message cannot set them, and the dialog of this node does not show them.

Setting	Why it is fixed
The application certificate, its key, its URI and its name	They identify this Node-RED instance, and the embedded server uses them too. A change breaks the trust that servers have in it.
The PKI folder and the trust decisions	Only the Certificate Manager makes trust decisions. A message cannot choose the PKI folder.
The session timeout, the transport timeout and the keep-alive	The node manages them. A wrong value gives disconnections that are hard to find.
name, pkiName, useTransport and the transport settings (maxChunkCount, maxMessageSize, receiveBufferSize, sendBufferSize)	They belong to the endpoint node, in the editor. A message with one of them gets an error message on that field.
The publishing interval, the keep-alive count and the lifetime count of a subscription	They work together. If these three values do not match, the server deletes the subscription and sends no error.