n8n says it's 'configured to use a secure cookie'? Keep it on: four fixes instead of N8N_SECURE_COOKIE=false

Description and use

Secure HTTPS access to self‑hosted n8n is achieved by using localhost, Tailscale Serve, local Caddy certificates, or a public reverse proxy, while keeping port 5678 private.

Problem

Self‑hosted n8n shows a secure‑cookie warning when accessed via HTTP or Safari, exposing the login session to plain‑text traffic.

Outcome

Secure HTTPS access to self‑hosted n8n is achieved without disabling secure cookies, protecting login sessions and preventing eavesdropping.

Workflow

• 1. Use http://localhost:5678 on the same machine to treat localhost as a secure origin.
• 2. For home lab/NAS, run tailscale serve 5678 to expose https://nas.your-tailnet.ts.net and set N8N_HOST, N8N_PROTOCOL, WEBHOOK_URL accordingly.
• 3. For LAN only, configure Caddy with an internal TLS certificate and point browsers to the Caddy domain, trusting the local root certificate.
• 4. For internet access, set up a public domain with Caddy reverse proxy, obtain a public cert, and configure N8N_HOST, N8N_PROTOCOL, WEBHOOK_URL, N8N_PROXY_HOPS.
• 5. Ensure port 5678 is not exposed by using 127.0.0.1:5678:5678 or omitting ports in Docker Compose.
• 6. If previously set N8N_SECURE_COOKIE=false, remove or set to true, restart, and re‑login over HTTPS.
• 7. Review security advisories, run n8n audit, and apply hardening checklist.

Evidence

Your n8n server is configured to use a secure cookie, however you are either visiting this via an insecure URL, or using Safari.

Source

N8N_SECURE_COOKIE defaults to true and, per n8n's security variables, "ensures that cookies are only sent over HTTPS".

Source

If the devices that use n8n are on your tailnet, Tailscale Serve puts a real HTTPS address in front of it without opening any port.

Source