The idea is:
The HTTP request node excludes every credential with isManaged=true from its credential dropdown. This prevents credentials from being used in a correct way, even when they have a strict allowHttpRequestDomains=domains allowlist. Dedicated nodes can use these credentials correctly, while a managed httpBearerAuth credentials cannot be selected by an HTTP Request node.
My use case:
When I import a set of credentials relevant to my workflows I import them with isManaged=true so that I can assign them to a user I invited to assist me with workflows without exposing the sensitive information. Some of my workflows require HTTP Requests nodes but the relevant credentials can not be selected. This forces me to go back to writing down passwords.
I think it would be beneficial to add this because:
It should be possible to use managed credentials in http request nodes. This decision was made before the introduction of allowedDomains but was never reconsidered now that protection is in place.
Any resources to support this?
Issues #12409 #12417 #17583
Are you willing to work on this?
I am unable to work on this, but I would propose: Distinguish between internally/proxy-managed credentials that must never be used by http request nodes and externally managed credentials that may be used when protected by an enforced domain allowlist.