Put every trigger endpoint behind an authentication subrequest

n8n's webhook, form and mcp endpoints carry no authentication of their own, and
for an automation platform those endpoints are the platform: whatever a
workflow reads or changes answers an unauthenticated request. The editor's
login protects the editor and nothing else.

N8N_WEBHOOK_AUTH_URL is required rather than optional — there is no way to
deploy this without naming an authenticator.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

This commit is contained in:

Stéphane Tailland

2026-08-31 07:56:03 +02:00

parent f0363748b6

commit e9d7504fcd

3 changed files with 96 additions and 0 deletions

									
										k8s/kustomization.yaml
									
		+1
		
												View File
												
				@@ -12,3 +12,4 @@ resources:

				  - n8n/service.yaml

				  - ingress/certificate.yaml

				  - ingress/ingress.yaml

				  - ingress/ingress-webhooks.yaml