There are three aspects of Node-RED that need to be secured.
Node-RED is a web application so you need to enable HTTPS access to the Node-RED runtime. The default Node-RED settings include a commented out section that can be used for local certificates.
The Node-RED editor and administration require authentication to access it. Node-RED supports username/password and OAuth/OpenID authentication. The adminAuth property in the setting file is used to specify the authentication credentials.
Securing the HTTP Node can be done using basic authentication. This can be set using the httpNodeAuth property in the settings file.
You can also follow our guide on how to secure Node-RED.