Form workflow stuck on waiting page after upgrade - CORS error with 'origin: null'

[Rugia]

Hi everyone,

After upgrading my self-hosted n8n instance (1.123.6 or 2.1.0), workflows with forms are getting stuck on the first page (doesn’t proceed to next page). The browser console shows:

Access to fetch at ‘…/form-waiting/…/n8n-execution-status’from origin ‘null’ has been blocked by CORS policy

Root cause?
I traced this to newest changes in packages/nodes-base/nodes/Form/utils/utils.ts where getWebhookSandboxCSP() is called. The generated CSP includes sandbox but is missing allow-same-origin, causing the browser to treat the page as origin: null and block the polling requests.

Workaround:
Adding this to my Nginx config fixes it:

proxy_hide_header Content-Security-Policy;
add_header Content-Security-Policy “sandbox allow-downloads allow-forms allow-modals allow-popups allow-scripts allow-same-origin allow-top-navigation-by-user-activation”;

Is this intentional, or should getWebhookSandboxCSP() include allow-same-origin for form pages?

Thanks!

[m0k3y]

Hello, recently I made a thread on GitHub.

Form trigger always looping

thankyou for confirming it. please help me post a comment to the thread.

[Wdym_Alookaparatha]

@Rugia

Hi everyone,

After upgrading my self-hosted n8n instance (1.123.6 or 2.1.0), workflows with forms are getting stuck on the first page (doesn’t proceed to next page). The browser console shows:

Access to fetch at ‘…/form-waiting/…/n8n-execution-status’from origin ‘null’ has been blocked by CORS policy

Root cause?
I traced this to newest changes in packages/nodes-base/nodes/Form/utils/utils.ts where getWebhookSandboxCSP() is called. The generated CSP includes sandbox but is missing allow-same-origin, causing the browser to treat the page as origin: null and block the polling requests.

Workaround:
Adding this to my Nginx config fixes it:

proxy_hide_header Content-Security-Policy;
add_header Content-Security-Policy “sandbox allow-downloads allow-forms allow-modals allow-popups allow-scripts allow-same-origin allow-top-navigation-by-user-activation”;

Is this intentional, or should getWebhookSandboxCSP() include allow-same-origin for form pages?

Thanks!

Ok so, , , ,Current CSP breaks Forms by forcing origin:pull.This is almost certainly a bug, not intended behavior.I found out that your Nginx fix is valid and safe.this should be fixed upstream by adding allow-same-origin for Form pages.