Can;t link to my self-hosted instance from outside (OAuth2 call as well?)

[schaepdlx]

Description of the problem

I can’t link to my instance from an outside link. For example;

https://n8n.domain.com/workflow/new

Also when trying to make a call with OAuth2, i have to put in the redirect URI, but the authorization never completes, because it doesn’t ‘come back’ to the link.

https://n8n.domain.com/rest/oauth2-credential/callback

Error message from browser:

n8n.domain.com refused to connect.
ERR_BLOCKED_BY_RESPONSE

Configuration

I have a self-hosted setup, which has traefik in front of it. I got it dynamically wired, so should be able to make fast changes where needed. This is the dynamic config of n8n for traefik:

http:
  middlewares:
    secure-headers:
      headers:
        stsSeconds: 31536000
        stsIncludeSubdomains: true
 #       stsPreload: true
        frameDeny: true
        browserXssFilter: true
        contentTypeNosniff: true

    n8n-headers:
      headers:
        customRequestHeaders:
          X-Forwarded-Proto: "https"
          X-Forwarded-Port: "443"
          X-Forwarded-Host: "n8n.merijnalbers.nl"
        frameDeny: false
        contentTypeNosniff: true

    n8n-cors:
      headers:
        accessControlAllowMethods: ["GET","POST","PUT","DELETE","OPTIONS"]
        accessControlAllowOriginList: ["https://n8n.domain.com"]
        accessControlAllowCredentials: true
        accessControlAllowHeaders: ["Accept","Authorization","Content-Type","X-N8N-API-KEY"]
        accessControlMaxAge: 600
        addVaryHeader: true
        customFrameOptionsValue: "ALLOW-FROM https://n8n.domain.com"  
        frameDeny: false

Information on your n8n setup

• n8n version: 1.114.4
• Database (default: SQLite): Postgres
• n8n EXECUTIONS_PROCESS setting (default: own, main): default
• Running n8n via (Docker, npm, n8n cloud, desktop app): docker (compose)
• Operating system: Ubuntu 24

[schaepdlx]

Had to do with; cross-origin-opener-policy

This test yaml in my dynamic config made it work. Now let’s see how to tune it better for security.

http:
  middlewares:
    n8n-headers:
      headers:
        frameDeny: false
        contentTypeNosniff: true
        browserXssFilter: true
        stsSeconds: 31536000
        stsIncludeSubdomains: true
        customResponseHeaders:
          Cross-Origin-Opener-Policy: "unsafe-none"
          Cross-Origin-Resource-Policy: "cross-origin"
          X-Frame-Options: "ALLOWALL"
          Content-Security-Policy: "frame-ancestors *"