n8n says it's 'configured to use a secure cookie'? Keep it on: four fixes instead of N8N_SECURE_COOKIE=false

说明与用途

通过使用 localhost、Tailscale Serve、本地 Caddy 证书或公共反向代理实现自托管 n8n 的安全 HTTPS 访问，并保持 5678 端口私有。

问题

Self‑hosted n8n shows a secure‑cookie warning when accessed via HTTP or Safari, exposing the login session to plain‑text traffic.

结果

Secure HTTPS access to self‑hosted n8n is achieved without disabling secure cookies, protecting login sessions and preventing eavesdropping.

工作流

• 1. Use http://localhost:5678 on the same machine to treat localhost as a secure origin.
• 2. For home lab/NAS, run tailscale serve 5678 to expose https://nas.your-tailnet.ts.net and set N8N_HOST, N8N_PROTOCOL, WEBHOOK_URL accordingly.
• 3. For LAN only, configure Caddy with an internal TLS certificate and point browsers to the Caddy domain, trusting the local root certificate.
• 4. For internet access, set up a public domain with Caddy reverse proxy, obtain a public cert, and configure N8N_HOST, N8N_PROTOCOL, WEBHOOK_URL, N8N_PROXY_HOPS.
• 5. Ensure port 5678 is not exposed by using 127.0.0.1:5678:5678 or omitting ports in Docker Compose.
• 6. If previously set N8N_SECURE_COOKIE=false, remove or set to true, restart, and re‑login over HTTPS.
• 7. Review security advisories, run n8n audit, and apply hardening checklist.

证据

Your n8n server is configured to use a secure cookie, however you are either visiting this via an insecure URL, or using Safari.

来源

N8N_SECURE_COOKIE defaults to true and, per n8n's security variables, "ensures that cookies are only sent over HTTPS".

来源

If the devices that use n8n are on your tailnet, Tailscale Serve puts a real HTTPS address in front of it without opening any port.

来源