FAQ and troubleshooting

Why is the console only reachable from my local machine?

By default, NodeUI binds strictly to 127.0.0.1 and rejects non-loopback requests with 403 Forbidden. This is a crucial security barrier so sensitive runtime data and heap snapshots are never exposed to local networks or the public internet. If you need remote access for internal teams, place an authenticated reverse proxy in front of the application.

Why does the Routes panel show "No Express router captured yet"?

NodeUI discovers Express routes lazily upon receiving the first request through the app router (Fastify, Hapi and Hono routes are collected from the framework as they are registered). Trigger any request against your backend API endpoints, then refresh the NodeUI dashboard. Koa and plain node:http have no router to introspect; call server.setRoutes([...]) to list yours.

How do I forward custom logger messages (Winston, Pino) to NodeUI?

NodeUI automatically captures native console.log/info/warn/error. For external loggers, use the provided helper method on the server instance:

server.addLogSource({ level: 'info', message: 'User logged in successfully' });

Why are my environment variables showing as [REDACTED]?

Keys containing terms like KEY, SECRET, TOKEN, PASSWORD, or AUTH are automatically masked for safety. You can disable masking by passing maskSecrets: false in your configuration options.

How does heap snapshot capture work with confirmation nonces?

Capturing heap snapshots is a mutating action. When triggered from the UI, a confirmation modal automatically requests a single-use nonce from POST /nodeui/api/confirmations and passes it in the x-nodeui-confirm header to POST /nodeui/api/heap-snapshot.