Node-RED Tutorial: Secure Flows with Bearer Tokens

Node-RED, an open-source, flow-based, lightweight programming tool, enables users to wire together flows by dragging and connecting nodes using a web browser interface. When it comes to securing these flows, particularly when dealing with APIs, understanding and implementing bearer tokens becomes vital. This article walks you through the concept of bearer tokens and their integration in Node-RED.

In the context of web APIs, a bearer token is a type of access token that allows access to the API resources server. A client, after obtaining a bearer token, can make an API request by including the token in the 'Authorization' header, proving that it's authorized to access the resource. This is what makes bearer tokens 'bearer agnostic' - they don't care about who the bearer is, only that they can present the token.

Understanding Bearer Tokens in Node-RED

In Node-RED, the node-red-bearer-authentication node provides a way to protect flows using JSON Web Tokens (JWT), which are a type of bearer token. Here's how you can use it.

Firstly, you need to understand how to obtain a valid JWT and how to use it in your flows. The basic process involves requesting a JWT by authenticating with a valid user account, and then using that JWT to access your secure flows.

Obtaining a JWT

The request-http-out and function nodes, when set up correctly, can be used to make an authentication request to your chosen API and return a JWT. Further configuration of the function node is required to parse and decode the JSON response, extracting the JWT.

For instance, imagine your API uses standard OpenID Connect for authentication. You'd first configure the request-http-out node to make a POST request to your API's token endpoint. Then, you'd feed the response into a function node, which decodes the JSON response and extracts the JWT:

```javascript let response = msg.payload; let decoded = JSON.parse(response); msg.payload = decoded.access_token; return msg; ```

Configuring the bearer-auth node

Once you have a valid JWT, you can configure the bearer-auth node to accept it. This node uses the 'Authorization' header in incoming requests to check that the included token is valid and authorized to access a particular flow or node. You need to configure this node correctly to point to the API's JWT secret, and specify the audience and issuer.

For a typical usage, the secret is a public key obtained from your token endpoint, the audience is the client ID of your Node-RED instance, and the issuer is the token endpoint URL.

Securing Node-RED Flows with Bearer Tokens

Now, let's look at two practical use-cases for bearer tokens in Node-RED: securing an entire flow and securing a single node.

Securing an entire flow is done by wrapping it in a `route` node, with the bearer-auth node as one of its children. This way, all incoming messages to that flow must first pass through the bearer-auth node and provide a valid JWT.

Protecting single nodes with bearer tokens

Securing a single node involves inserting the bearer-auth node in the flow, before the node you want to protect. This ensures the message containing the request hits the bearer-auth node first, and only passes if the token is valid.

In most cases, you'd want to configure your API to return a JWT with an appropriate lifespan, and refresh the token as necessary. Depending on your API's implementation, this may involve normalizing the lifespan of your JWT with the `access-token-refresh` node, or using a Node-RED dashboard with an 'eye' symbol to force access token renewal.

Managing bearer tokens in Node-RED requires careful configuration but ultimately provides a robust way to secure your flows. Staying informed about best practices and continuously updating your configurations ensures the highest level of protection for your data.