Admin authentication with virtual keyboard and session timeout
An industrial touchscreen has no physical keyboard, but the settings page of your HMI still needs protection. This example adds admin authentication to a Node-RED dashboard running on a TouchBerry Pi: a popup with an on-screen keyboard asks for the password, and a configurable session timeout decides when to ask again. It comes from a real deployment — an industrial mixing line where operators use the panel all day but only supervisors may change parameters.
Three function nodes do all the work
One function initialises the credentials and timeout in global context at deploy time. A second one runs when the operator taps "Settings": if the last successful login is newer than adminLoginTimeout, it lets the user straight through; otherwise it opens the keyboard popup. The third validates the typed password and stamps lastAdminLoginDate on success. Each path ends in a ui-control node that navigates to the protected page.
Session timeout instead of constant prompts
Asking for a password on every tap would make the panel unusable, especially with work gloves on. Storing the login timestamp in global context gives you a sliding session: every authorised action renews it, and after ten idle minutes (the adminLoginTimeout variable, fully configurable) the panel quietly locks itself again. An optional logout button simply nulls the timestamp, handy when the supervisor walks away from the machine.
Keep secrets out of the flow export
The password lives in a global variable loaded from an environment variable at deploy time, never hard-coded in the flow JSON you will inevitably export, back up and share with colleagues. Error messages are deliberately vague ("wrong password", no hints about length or characters), and the same global session check is reused by every other flow that needs it — for example to gate the forced-start button on the mixing machine.
A snippet from the implementation
Straight from the example as deployed on the TouchBerry Pi — copy it freely:
global.set("adminPwd", env.get("ADMIN_PWD") || "CAMBIAR_PASSWORD");
global.set("adminLoginTimeout", 10 * 60 * 1000); // 10 minutes in ms
global.set("lastAdminLoginDate", null); // nobody logged in at startup
return msg;
// ============================================================
// function 2: validatePassword (receives msg from the virtual keyboard)
// ------------------------------------------------------------
// msg.payload == true -> the operator pressed OK
// msg.input -> text entered on the on-screen keyboard
// Output 1: access granted / Output 2: rejected
// ============================================================
if (msg.payload) {
if (msg.input == global.get("adminPwd")) {
// Access granted: record the instant for the session timeout
global.set("lastAdminLoginDate", new Date());
msg.auth = true;
msg.payload = "Administrator access granted";
return [msg, null];
}
// Incorrect password: do not reveal hints in the message
msg.auth = false;
msg.payload = "Incorrect password";
return [null, msg];
}
return [null, null]; // popup cancelled: do nothing
// ============================================================The full example is a complete program — wiring header, setup and main loop — ready to adapt to your application.
Frequently asked questions
How do I add an on-screen keyboard to a Node-RED dashboard?
Use a ui-template node with an HTML input plus a virtual keyboard, or enable an OS-level keyboard such as matchbox-keyboard on Raspberry Pi OS so any focused field pops it up.
Can I have several user levels in Node-RED dashboard?
Yes. Store one timestamp per role (operator, supervisor, admin) in global context and check the matching one in each protected flow.
Is this a replacement for securing the Node-RED editor?
No. This protects dashboard pages for operators. The editor itself should be secured separately with adminAuth and HTTPS in settings.js.